Unify address book searches. See ChangeLog comments. Also, fixed bug wherein file...

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14242 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/doc/ChangeLog b/doc/ChangeLog
index 40153a50c2b38206ccf443db2ba672216aa4ba29..78a7820a6cc74cb27278f731e2553b8ed48be889 100644 (file)
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -369,6 +369,9 @@ Version 1.5.2 - SVN
   - Fixed XSS problem with unsanitized style tags in messages. [CVE-2011-2023]
   - Always ensure that the Reply-To header is a full email address in
     outgoing messages
   - Fixed XSS problem with unsanitized style tags in messages. [CVE-2011-2023]
   - Always ensure that the Reply-To header is a full email address in
     outgoing messages

+  - Unified address book searches somewhat: file-backed address books now
+    search in each field individually; database-backed address books now
+    search in fields other than first/last name (nickname, email)

 
 Version 1.5.1 (branched on 2006-02-12)
 --------------------------------------
 
 Version 1.5.1 (branched on 2006-02-12)
 --------------------------------------

diff --git a/functions/abook_database.php b/functions/abook_database.php
index c1cc0cd685a57fe6fbb22f7ed32584b834fe0a1c..1d15f9c74d76a1f2597a176b3973c4df5cccaccd 100644 (file)
--- a/functions/abook_database.php
+++ b/functions/abook_database.php
@@ -264,8 +264,12 @@ class abook_database extends addressbook_backend {
         $escape = 'ESCAPE \'' . $this->dbh->quoteString('\\') . '\'';
     
         $query = sprintf("SELECT * FROM %s WHERE owner='%s' AND " .
         $escape = 'ESCAPE \'' . $this->dbh->quoteString('\\') . '\'';
     
         $query = sprintf("SELECT * FROM %s WHERE owner='%s' AND " .

-                         "(LOWER(firstname) LIKE '%s' %s OR LOWER(lastname) LIKE '%s' %s)",
-                         $this->table, $this->owner, $expr, $escape, $expr, $escape);
+                         "(LOWER(firstname) LIKE '%s' %s " .
+                         "OR LOWER(lastname) LIKE '%s' %s " .
+                         "OR LOWER(email) LIKE '%s' %s " .
+                         "OR LOWER(nickname) LIKE '%s' %s)",
+                         $this->table, $this->owner, $expr, $escape, $expr, $escape,
+                                                     $expr, $escape, $expr, $escape);

 
         $res = $this->dbh->query($query);
 
 
         $res = $this->dbh->query($query);
 

diff --git a/functions/abook_local_file.php b/functions/abook_local_file.php
index 97838dcf82faed0b33d3525f200c36e8312469d7..23063d3de08a9d94064916b743e4535259ddaf5e 100644 (file)
--- a/functions/abook_local_file.php
+++ b/functions/abook_local_file.php
@@ -274,10 +274,9 @@ class abook_local_file extends addressbook_backend {
         if ($expr=='*' && ! $this->listing)
             return array();
 
         if ($expr=='*' && ! $this->listing)
             return array();
 

-        /* Make regexp from glob'ed expression
-         * May want to quote other special characters like (, ), -, [, ], etc. */
-        $expr = str_replace('?', '.', $expr);
-        $expr = str_replace('*', '.*', $expr);
+        // Make regexp from glob'ed expression
+        $expr = preg_quote($expr);
+        $expr = str_replace(array('\\?', '\\*'), array('.', '.*'), $expr);

 
         $res = array();
         if(!$this->open()) {
 
         $res = array();
         if(!$this->open()) {


@@ -295,13 +294,15 @@ class abook_local_file extends addressbook_backend {
                 $oTemplate->display('footer.tpl');
                 die();
             } else {
                 $oTemplate->display('footer.tpl');
                 die();
             } else {

-                $line = join(' ', $row);

                 /**
                  * TODO: regexp search is supported only in local_file backend.
                  * Do we check format of regexp or ignore errors?
                  */
                 // errors on preg_match call are suppressed in order to prevent display of regexp compilation errors
                 /**
                  * TODO: regexp search is supported only in local_file backend.
                  * Do we check format of regexp or ignore errors?
                  */
                 // errors on preg_match call are suppressed in order to prevent display of regexp compilation errors

-                if(@preg_match('/' . $expr . '/i', $line)) {
+                if (@preg_match('/' . $expr . '/i', $row[0])    // nickname
+                 || @preg_match('/' . $expr . '/i', $row[1])    // firstname
+                 || @preg_match('/' . $expr . '/i', $row[2])    // lastname
+                 || @preg_match('/' . $expr . '/i', $row[3])) { // email

                     array_push($res, array('nickname'  => $row[0],
                         'name'      => $this->fullname($row[1], $row[2]),
                         'firstname' => $row[1],
                     array_push($res, array('nickname'  => $row[0],
                         'name'      => $this->fullname($row[1], $row[2]),
                         'firstname' => $row[1],