Fix: 2974

Author: jaapmarcus

web/search/index.php

@@ -11,6 +11,12 @@
 // Check token
 verify_csrf($_GET);
 
+if (empty($_GET['u'])){
+    $_GET['u'] = '';
+}
+if (empty($_GET['q'])){
+    $_GET['q'] = '';
+}
 // Data
 $q = quoteshellarg($_GET['q']);
 $u = quoteshellarg($_GET['u']);

web/templates/pages/list_search.html

@@ -143,7 +143,7 @@
 				</div>
 				<div class="clearfix l-unit__stat-col--left text-center"><?=translate_date($value['DATE'])?></div>
 				<div class="clearfix l-unit__stat-col--left text-center"><b>
-						<a href="/search/?q=<?=htmlspecialchars($q); ?>&u=<?=$value['USER']; ?>"><?=$value['USER']; ?></a></b></div>
+						<a href="/search/?q=<?=htmlentities($_GET['q']); ?>&u=<?=$value['USER']; ?>&token=<?=$_SESSION['token']?>"><?=$value['USER']; ?></a></b></div>
 				<div class="clearfix l-unit__stat-col--left text-center"><?=_($object)?></b></div>
 			</div>
 		</div>