fix(ui): saving configuration > meta services filters

centreon · Apr 1, 2019 · 214d142 · 214d142
1 parent 65fed65
commit 214d142
Showing 1 changed file with 14 additions and 11 deletions.
diff --git a/www/include/configuration/configObject/meta_service/listMetaService.php b/www/include/configuration/configObject/meta_service/listMetaService.php
@@ -41,23 +41,26 @@
 
 include "./include/common/autoNumLimit.php";
 
-$search = null;
-if (isset($_POST['searchMS'])) {
-    $search = $_POST['searchMS'];
-    $centreon->historySearch[$url] = $search;
-} elseif (isset($_GET['searchMS'])) {
-    $search = $_GET['searchMS'];
-    $centreon->historySearch[$url] = $search;
-} elseif (isset($centreon->historySearch[$url])) {
-    $search = $centreon->historySearch[$url];
+$search = filter_var(
+    $_POST['searchMS'] ?? $_GET['searchMS'] ?? null,
+    FILTER_SANITIZE_STRING
+);
+
+if (isset($_POST['searchMS']) || isset($_GET['searchMS'])) {
+    //initializing filters values
+    $centreon->historySearch[$url] = array();
+    $centreon->historySearch[$url]["searchMS"] = $search;
+} else {
+    //restoring saved values
+    $search = $centreon->historySearch[$url]["searchMS"] ?? null;
 }
 
 /*
  * Meta Service list
  */
 $rq = "SELECT SQL_CALC_FOUND_ROWS * FROM meta_service ";
 if ($search) {
-    $rq .= "WHERE meta_name LIKE '%" . htmlentities($search, ENT_QUOTES, "UTF-8") . "%' " .
+    $rq .= "WHERE meta_name LIKE '%" . $search . "%' " .
         $acl->queryBuilder("AND", "meta_id", $metaStr);
 } else {
     $rq .= $acl->queryBuilder("WHERE", "meta_id", $metaStr);
@@ -96,7 +99,7 @@
  */
 if ($search) {
     $rq = "SELECT * FROM meta_service " .
-        "WHERE meta_name LIKE '%" . htmlentities($search, ENT_QUOTES, "UTF-8") . "%' " .
+        "WHERE meta_name LIKE '%" . $search . "%' " .
         $acl->queryBuilder("AND", "meta_id", $metaStr) .
         " ORDER BY meta_name LIMIT " . $num * $limit . ", " . $limit;
 } else {