Ticket #5656: mythweb-5656-escape_regex_special_characters_in_filenames.patch

mythweb/classes/Database/mysqlicompat.php

@@ -88 +88 @@
     }
 
 /**
+ * Changes the regexp-special square brackets used for character class/range
+ * operations to the "match any single character" operator, '.'.  This function
+ * does not do database-special character escapes.
+ *
+ * @param string $string    string to escape
+ *
+ * @return string           escaped string
+/**/
+    function escape_regex($string) {
+    // Null?
+        if (is_null($string))
+            return 'NULL';
+    // Just a string
+        $escaped_string = str_replace('[', '.', $string);
+        return str_replace(']', '.', $escaped_string);
+    }
+
+/**
  *  Returns an un-executed Database_Query_mysqlicompat object
  *
  *  @param string $query    The query string

mythweb/classes/Database/mysql.php

@@ -81 +81 @@
     }
 
 /**
+ * Changes the regexp-special square brackets used for character class/range
+ * operations to the "match any single character" operator, '.'.  This function
+ * does not do database-special character escapes.
+ *
+ * @param string $string    string to escape
+ *
+ * @return string           escaped string
+/**/
+    function escape_regex($string) {
+    // Null?
+        if (is_null($string))
+            return 'NULL';
+    // Just a string
+        $escaped_string = str_replace('[', '.', $string);
+        return str_replace(']', '.', $escaped_string);
+    }
+
+/**
  *  Returns an un-executed Database_Query_mysql object
  *
  *  @param string $query    The query string

mythweb/modules/video/handler.php

@@ -226 +227 @@
     if (isset($_SESSION['video']['path'])) {
         $escaped_path = str_replace('(', '\\(',$_SESSION['video']['path']);
         $escaped_path = str_replace(')', '\\)',$_SESSION['video']['path']);
-        $where .= ' AND videometadata.filename RLIKE '.$db->escape($escaped_path.'[/]*[^/]*$');
+        $where .= ' AND videometadata.filename RLIKE '.$db->escape($db->escape_regex($escaped_path).'[/]*[^/]*$');
     }
 // Deal with the parental locks
     if (isset($_REQUEST['VideoAdminPassword']))