Ticket #1129: sanitize_tags-deprecation_notice-in-ops.diff

manage_user.php

@@ -97 +97 @@
 
 if (isset($_POST['search_submit'])){
     $search_name = post_str('search_text');
-    $search_name = BoincDb::escape_string(strip_tags($search_name));
+    $search_name = BoincDb::escape_string(sanitize_tags($search_name));
 
     if (!empty($search_name)){ 
         $result = mysql_query("SELECT * FROM user WHERE name='$search_name'");

clean_user_names.php

@@ -16 +16 @@
 // You should have received a copy of the GNU Lesser General Public License
 // along with BOINC.  If not, see <http://www.gnu.org/licenses/>.
 
+// DEPRECATED: this was used to clean user names from html that was allowed at this time
+
+die("This file is DEPRECATED, see source for more information.");
+
 $cli_only = true;
 require_once("../inc/db.inc");
 require_once("../inc/util_ops.inc");
@@ -24 +28 @@
 db_init();
 
 function clean_user($user) {
-    if ($user->name != strip_tags($user->name)) {
-        $x = strip_tags($user->name);
+    if ($user->name != sanitize_tags($user->name)) {
+        $x = sanitize_tags($user->name);
         echo "ID: $user->id
 name: $user->name
 stripped name: $x