ISTI Open Access

The problem is with the ' in the query

The following queries both return the 12 records we have

https://openportal.isti.cnr.it/results?qv=andrea+dell+amico

https://openportal.isti.cnr.it/results?qv=andrea+amico

yet they are not the solution. We should find a solution since also the browse by author fails to display the 12 records.

These are the queries associated with the browse ...

• https://openportal.isti.cnr.it/results?qf=cnrautb&qv=Andrea%20Dell%27Amico
• https://openportal.isti.cnr.it/results?qf=cnrautb&qv=Felice%20Dell%27Orletta

We do have 14 authors with ' in the name ... see screenshot.

The bug has been introduced recently to fix a XSS vulnerability.

In particular I changed the read of each input parameter from:

$mainValue  = $jinput->get('qv', '', 'STRING');

to

$mainValue  = htmlspecialchars($jinput->get('qv', '', 'STRING'), ENT_QUOTES);

The problem was mainly related with the parameter of the free search, so I changed only the read of the browse parameter in:

$mainValue  = htmlspecialchars($jinput->get('qv', '', 'STRING'), ENT_COMPAT);

I confirm the query

https://openportal.isti.cnr.it/results?qf=cnrautb&qv=Andrea%20Dell%27Amico

is now working again.