Use str_replace for matching searchwords, thanks to Dietrich Raisin

diff --git a/docs/NEWS b/docs/NEWS
index a6ce40e7ff87234d7b5b525732dd023407ca5a9e..51ebd0fa81cc99fe9408f4cdca73a57cf9b7dfac 100644 (file)
--- a/docs/NEWS
+++ b/docs/NEWS
@@ -3,6 +3,10 @@
 Version 1.3 ()
 ------------------------------------------------------------------------
 
+    * Highlighting searched words in entries now uses str_replace instead
+      of slower and possibly insecure preg_replace(). Thanks to
+      Dietrich Raisin!
+      
     * New plugin API method "parseTemplate($filename)" to allow a
       sidebar- or event-plugin to fetch+display a smarty template.
       (garvinhicking)

diff --git a/include/functions_entries.inc.php b/include/functions_entries.inc.php
index 44e3188dcdb09c212273c099d796e23accf7342b..3258f63fa2198252a323f9ed7586b4199440e599 100644 (file)
--- a/include/functions_entries.inc.php
+++ b/include/functions_entries.inc.php
@@ -970,7 +970,7 @@ function serendipity_printEntries($entries, $extended = 0, $preview = false, $sm
                 $searchterms = explode($searchterms, ' ');
                 foreach($searchterms as $searchdx => $searchterm) {
                     $searchclass = "foundterm foundterm".$searchdx;
-                    $entry['body'] = preg_replace('/('.$searchterm.')/mi', '<span class="'.$searchclass.'">\1</span>', $entry['body']);
+                    $entry['body'] = str_replace($searchterm, '<span class="'.$searchclass.'">' . $searchterm . '</span>', $entry['body']);
                 }
             }