diff options
| author | neobooru | 2021-04-12 10:42:58 +0200 |
|---|---|---|
| committer | neobooru | 2021-04-12 10:42:58 +0200 |
| commit | 4ce72fa712918934fec019743dabc3387b2b6bcc (patch) | |
| tree | 777f2069c6f82d37d58f6b6e47dae47fa043dcff | |
| parent | 7c37734fec508f82f757c299175674b755d0ac71 (diff) | |
client/tags: escape dots in search term and don't allow '.' and '..' as tags
| -rw-r--r-- | client/js/controls/tag_input_control.js | 3 | ||||
| -rw-r--r-- | client/js/util/misc.js | 2 |
2 files changed, 3 insertions, 2 deletions
diff --git a/client/js/controls/tag_input_control.js b/client/js/controls/tag_input_control.js index 2207f41..1ac1cb3 100644 --- a/client/js/controls/tag_input_control.js +++ b/client/js/controls/tag_input_control.js @@ -163,7 +163,8 @@ class TagInputControl extends events.EventTarget { addTagByName(name, source) { name = name.trim(); - if (!name) { + // Tags `.` and `..` are not allowed, see https://github.com/rr-/szurubooru/pull/390 + if (!name || name == "." || name == "..") { return; } return Tag.get(name).then( diff --git a/client/js/util/misc.js b/client/js/util/misc.js index 4f9d6d3..756ad84 100644 --- a/client/js/util/misc.js +++ b/client/js/util/misc.js @@ -187,7 +187,7 @@ function arraysDiffer(source1, source2, orderImportant) { } function escapeSearchTerm(text) { - return text.replace(/([a-z_-]):/g, "$1\\:"); + return text.replace(/([a-z_-]):/g, "$1\\:").replace(/\./g, "\\."); } function dataURItoBlob(dataURI) { |