XF 2.0 Link for search all threads with a particular prefix

AndreaDB

Member

Kirby

Well-known member
Hi Joe,
I did not have any kind of support from the Xenforo team and I developed a simple PHP callback on my own that I recall from a Xenforo page node. With this I can search by one or more threads prefixes in the whole forum.
Note that the attached code is very basic, the code not use the forum search engine and has comments and output in Italian but works perfectly on the latest version of XF2.
Wow, that is really ugly and potentially dangerous code (SQL injection).

I've attached a little Add-on that should solve this in a more proper way:
It does allow to use advanced search on threads by selecting just a prefix.
 

Attachments

  • Kirby-SearchThreadsByPrefixOnly-1.0.1.zip
    2.9 KB · Views: 4
Last edited:

AndreaDB

Member
I don't remember if I had already included it in this version but there were some preg_replace to avoid SQL injection. I wanted to check but my post has been deleted!
 

Kirby

Well-known member
This is not what I requested!
Hmm, maybe I misunderstood your request, but didn't you want to search for Threads by just providing the pefix (and optinally nodes) as advanced search parameters without also specifying a keyword or user?
This is what this Add-on does allow you to do, such a search URL would be search/search?search_type=post&c[prefixes][]=35

You have eliminated my contribution which had no dangers of SQL injection.
I have not eliminated anything, I do not even have pemission to delete posts - this was done by XF staff, most likely because they considered the code to be insecure.

preg_replace is not the proper way to sanitize data for MySQL; there are method in the DB class to do that.

Update
I've tested your code (didn't do that before, just looked at it) and it does indeed produce an SQL injection and contains no preg_replace
 
Last edited:

BlueSquares

Member
This is what this Add-on does allow you to do, such a search URL would be search/search?search_type=post&c[prefixes][]=35

Kirby, thanks for the Addon. I can't get my Prefix search to come up by using the code above in the URL. Am I missing a setting or prerequisite anywhere? Or am I structuring the URL incorrectly? I've tried the following with my '5' prefix:

Code:
https://www.mydomain.com/search/search?search_type=post&c[prefixes][]=5
[/icode]
 

Kirby

Well-known member
Kirby, thanks for the Addon. I can't get my Prefix search to come up by using the code above in the URL. Am I missing a setting or prerequisite anywhere? Or am I structuring the URL incorrectly? I've tried the following with my '5' prefix:
The Add-on was written for XenForo 2.1.7, it does not work for XenForo 2.1.8+ which contains this bugfix:

I've attached an updated version that should work for 2.1.8+
 

Attachments

  • Kirby-SearchThreadsByPrefixOnly-1.1.0.zip
    2.3 KB · Views: 4
Last edited:
Top