From 211569ef85f50891035e3e2645ec0c87badec1e1 Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Wed, 21 Jan 2015 00:44:26 +0100
Subject: Minz: missing URL key/param encoding

Caused searches such as "intitle:&amp;" to fail after paging, and
possible XSS vulnerabilities.
Discovered during https://github.com/FreshRSS/FreshRSS/issues/754
---
 app/layout/header.phtml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

(limited to 'app/layout/header.phtml')

diff --git a/app/layout/header.phtml b/app/layout/header.phtml
index 2b968252b..41a63a565 100644
--- a/app/layout/header.phtml
+++ b/app/layout/header.phtml
@@ -25,8 +25,7 @@ if (FreshRSS_Auth::accessNeedsAction()) {
 		<?php if (FreshRSS_Auth::hasAccess() || FreshRSS_Context::$system_conf->allow_anonymous) { ?>
 		<form action="<?php echo _url('index', 'index'); ?>" method="get">
 			<div class="stick">
-				<?php $search = Minz_Request::param('search', ''); ?>
-				<input type="search" name="search" id="search" class="extend" value="<?php echo $search; ?>" placeholder="<?php echo _t('gen.menu.search'); ?>" />
+				<input type="search" name="search" id="search" class="extend" value="<?php echo FreshRSS_Context::$search; ?>" placeholder="<?php echo _t('gen.menu.search'); ?>" />
 
 				<?php $get = Minz_Request::param('get', ''); ?>
 				<?php if ($get != '') { ?>
-- 
cgit v1.2.3