Skip to content

Commit f2e4629

Browse files
committed
Quote Lookup search terms for FTS in MySQL/MariaDB and Oracle
This prevents misinterpretation of special characters (e.g., '@', '-') as operators in MySQL/MariaDB or reserved characters in Oracle Text.
1 parent 3a240c6 commit f2e4629

1 file changed

Lines changed: 21 additions & 1 deletion

File tree

html/RTIR/Tools/Elements/LookupRelatedTickets

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,27 @@ if ( $LookupType && RT::IR->CustomFields( Field => $LookupType ) ) {
7272
unless (RT->Config->Get('FullTextSearch')->{Enable}) {
7373
RT->Logger->error("Asked to run a full text search from Lookup.html without full text search enabled, see %FullTextSearch in RT_Config.pm");
7474
}
75-
$query = "Content LIKE '$q'";
75+
# Email addresses, hostnames, etc. contain characters that several
76+
# FTS engines treat as reserved operators ('@' and '-' are
77+
# proximity/NOT in MySQL/MariaDB BOOLEAN MODE; both are reserved in
78+
# Oracle Text). Wrap the term using each engine's literal/phrase
79+
# syntax so it is searched verbatim. Pg's plainto_tsquery()
80+
# tokenizes and ignores punctuation, so no wrapping is required
81+
# there.
82+
my $db_type = RT->Config->Get('DatabaseType');
83+
if ( $db_type eq 'mysql' ) {
84+
my $phrase = $q;
85+
$phrase =~ s/(["\\])/\\$1/g;
86+
$query = qq{Content LIKE '"$phrase"'};
87+
}
88+
elsif ( $db_type eq 'Oracle' ) {
89+
my $phrase = $q;
90+
$phrase =~ s/([\\}])/\\$1/g;
91+
$query = qq{Content LIKE '{$phrase}'};
92+
}
93+
else {
94+
$query = "Content LIKE '$q'";
95+
}
7696
}
7797
my $age = RT->Config->Get('RTIR_OldestRelatedTickets') || 60;
7898
$query = "$query AND LastUpdated > '$age days ago'";

0 commit comments

Comments
 (0)