Ajax Search in menu not escaping input.

[efullman]

Hi,

Thanks for all your hard work on the Kleo theme updates.

I’m using the Ajax Search in the menu, and when you click on one of “View Member Results”, “View All Results”, etc. the follow on search isn’t escaped. When you look at the link for one of these secondary views it reads, …?s=Term1 Term2 versus, …?s=Term1%20%Term2.

I did try to disable some of the plugins, but to make this search work I need a lot of them running (Buddypress, bbPress, etc.)

Thanks in advance for ideas to work around this.

[efullman]

A little more investigation, the actual $search_string seems delivers, …?s=Term1%2520Term2 instead of …?s=Term1%20Term2. However, when I echo the $searchstring its not escaped.

The actual place where the $searchstring is passed in a search URL is in theme-functions.php on line 716 for members, 736 for groups, and 804 for posts.

This is where the unescaped $searchstring gets put into the drop down menu for the “View All Results”, etc.
It doesn’t look like the esc_attr is working.

[efullman]

Sorry a little more… The search works with “,” but not with a space between the terms.

[efullman]

I tested just the regular Kleo Search Form in VC on a page, and it won’t take a space either, and creates the same error. Is this unique to my install (e.g. plugins, etc.) or the way it is supposed to work?

I guess I need a general way to enter search terms with spaces. I think it would be hard to ask users to remember not to use spaces in the search bar.

[Laura]

Hello, will assign the ticket to a higher support level who can help and advise you in your query.
Thanks! 🙂

Hi there!!! Help others from the community and mark any reply as solution if it solved your question. Mark as a solution

Laura Solanes - Graphic Designer and Web Designer

Please be patient as I try to answer each topic as fast as i can.

If you like the theme or the support you've received please consider leaving us a review on Themeforest!

Always happy to help you 🙂

[Andrei]

Hi and sorry for the late reply, indeed in the source of the search functionality there was a lack of esc_url function on those generated links, but adding the escape doesn’t change anything, but, just to be safe, I’ll add them for next theme updates.

In our live demo, you can test the search over here ( http://seventhqueen.com/themes/kleo/pinterest/ ) , and you will see that searching for the “kleo post” keywords will produce the following url ( http://seventhqueen.com/themes/kleo/?s=kleo%20post ) which I think it’s normally formatted.

If your issue is still present please let me know so we can give an extra look into it.

Cheers

Hi there!!! Help others from the community and mark any reply as solution if it solved your question. Mark as a solution

[Author]

Posts