Feature Proposals » New mode="search" encoding in ENCODE and URLPARAM

Motivation

The WebSearch currently has a URLPARAM enclosed in the SEARCH. When you search for a TWiki variable like %BR%, the variable gets passed along expanded to the SEARCH, even though the user expects the search to be literal.

Description and Documentation

Add a new mode="search" to ENCODE and URLPARAM to substitute the % char with a non-printable char, so that TWiki variables passed into the URLPARAM are not expanded.

SEARCH is reversing the substitution back to the % char before any search action is taken.

This is a special case to address code injection concerns.

Examples

The WebSearch and other search places are change from encode="quote" to encode="search" as in this example:

%SEARCH{ 
 "%URLPARAM{"search" encode="search"}%" 
 ...
}%

Impact

Implementation

-- Contributors: Peter Thoeny - 2018-07-14

Discussion

Accepted by ad hoc release meeting done today before the production release.

-- Peter Thoeny - 2018-07-14

This is now merged to core. WebSearch, WebSearchAdvanced and WebRssBase are updated as well.

-- Peter Thoeny - 2018-07-15