Mybb: Search fails to throw errors if keywords is met with specific criteria

[yuliu]

For standard search, keywords like or, orand, and, etc.: after clean_keywords() on input, the variable holding the keywords is an empty string.

And for fulltext search, keywords whose length is less than minsearchword: after clean_keywords_ft() on input, the variable holding the keywords is an empty string.

Both perform_search_mysql() and perform_search_mysql_ft() will neither process empty strings as keywords nor throw any error. And finally all records matching other search criteria will be returned.

[effone]

Worse case:
Searching with keyword like andro throws error stating "The minimum search term length is 3 characters."

[yuliu]

Worse case:
Searching with keyword like andro throws error stating "The minimum search term length is 3 characters."

Hmm, didn't think of that.. Then android will also match roid, and likewise orb will probably fail to search and organization will match ganization.

Following way of removing or or and from beginning of keywords isn't good:
https://github.com/mybb/mybb/blob/19e30a01d9680ea873c74b619443f57e1ae74a41/inc/functions_search.php#L213-L221

I think it can be fixed by appending a space .

A related issue here: it may not work well with consecutive combinations of or and and (keywords like or and and and or and), but will be taken care of in perform_search_mysql() and perform_search_mysql_ft(). However the search engine will fail to find an exact sequence of such string, even by double quoting it "or and and and or and".

[effone]

That exactly I thought, to append a space after and / or.
I also was making a rough PR, but the solution doesn't seem full proof to me wrt. the situation.

[yuliu]

I think a PR having following fixes would be enough for this issue:

• Append a space to and and or that are used to match and remove themselves from keyword's beginning in clean_keywords().
• Throw errors in perform_search_mysql() and perform_search_mysql_ft() when keyword is empty.

Other issues about search patterns which requires rework should be addressed in a separated issue and that would be difficult (do we have to support AND / OR operands and double quoted text for exact search).

[rajat315315]

Can I do a PR?

[euantorano]

Anyone can feel free to do a PR for any open issue at any time, do not feel like you have to ask. Thanks!

On Tue, 23 Jun 2020, at 20:43, rajat315315 wrote:

Can I do a PR?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/mybb/mybb/issues/4033#issuecomment-648378912, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAFW24JY4GCK7MMBJTALB2TRYEAW3ANCNFSM4NOZAT5Q.