BugTrack/447: 検索文字列を数値参照に変換

diff --git a/func.php b/func.php
index e19baf0..acd3223 100644 (file)
--- a/func.php
+++ b/func.php
@@ -2,7 +2,7 @@
 /////////////////////////////////////////////////
 // PukiWiki - Yet another WikiWikiWeb clone.
 //
-// $Id: func.php,v 1.48 2003/07/14 06:49:31 arino Exp $
+// $Id: func.php,v 1.49 2003/09/03 02:01:02 arino Exp $
 //
 
 // ʸ»úÎó¤¬InterWikiName¤«¤É¤¦¤«
@@ -131,11 +131,7 @@ function get_search_words($words,$special=FALSE)
                // # JIS X 0208 ¤¬ 0ʸ»ú°Ê¾å³¤¤¤Æ # ASCII, SS2, SS3 ¤Þ¤¿¤Ï½ªÃ¼
                $eucpost = '(?=(?:[\xA1-\xFE][\xA1-\xFE])*(?:[\x00-\x7F\x8E\x8F]|\z))';
        }
-       // $special : htmlspecialchars()¤òÄ̤¹¤«
-       $quote_func = create_function('$str',$special ?
-               'return preg_quote($str,"/");' :
-               'return preg_quote(htmlspecialchars($str),"/");'
-       );
+       $quote_func = create_function('$str','return preg_quote($str,"/");');
        // LANG=='ja'¤Ç¡¢mb_convert_kana¤¬»È¤¨¤ë¾ì¹ç¤Ïmb_convert_kana¤ò»ÈÍÑ
        $convert_kana = create_function('$str,$option',
                (LANG == 'ja' and function_exists('mb_convert_kana')) ?
@@ -150,15 +146,20 @@ function get_search_words($words,$special=FALSE)
                for ($pos = 0; $pos < mb_strlen($word_zk);$pos++)
                {
                        $char = mb_substr($word_zk,$pos,1);
-                       $arr = array($quote_func($char));
+                       // $special : htmlspecialchars()¤òÄ̤¹¤«
+                       $arr = array($quote_func($special ? htmlspecialchars($char) : $char));
                        if (strlen($char) == 1) // ±Ñ¿ô»ú
                        {
-                               $_char = strtoupper($char); // Âçʸ»ú
-                               $arr[] = $quote_func($_char);
-                               $arr[] = $quote_func($convert_kana($_char,"A")); // Á´³Ñ
-                               $_char = strtolower($char); // ¾®Ê¸»ú
-                               $arr[] = $quote_func($_char);
-                               $arr[] = $quote_func($convert_kana($_char,"A")); // Á´³Ñ
+                               foreach (array(strtoupper($char),strtolower($char)) as $_char)
+                               {
+                                       if ($char != '&')
+                                       {
+                                               $arr[] = $quote_func($_char);
+                                       }
+                                       $ord = ord($_char);
+                                       $arr[] = sprintf('&#(?:%d|x%x);',$ord,$ord); // ¼ÂÂλ²¾È
+                                       $arr[] = $quote_func($convert_kana($_char,"A")); // Á´³Ñ
+                               }
                        }
                        else // ¥Þ¥ë¥Á¥Ð¥¤¥Èʸ»ú
                        {

diff --git a/html.php b/html.php
index efec709..b10ba27 100644 (file)
--- a/html.php
+++ b/html.php
@@ -2,7 +2,7 @@
 /////////////////////////////////////////////////
 // PukiWiki - Yet another WikiWikiWeb clone.
 //
-// $Id: html.php,v 1.94 2003/08/20 10:58:47 arino Exp $
+// $Id: html.php,v 1.95 2003/09/03 02:01:02 arino Exp $
 //
 
 // ËÜʸ¤ò½ÐÎÏ
@@ -77,14 +77,12 @@ function catbody($title,$page,$body)
                        $keys[$word] = strlen($word);
                }
                arsort($keys,SORT_NUMERIC);
-               $keys = get_search_words(array_keys($keys));
+               $keys = get_search_words(array_keys($keys),TRUE);
                $id = 0;
                foreach ($keys as $key=>$pattern)
                {
                        $s_key = htmlspecialchars($key);
-                       $pattern = ($s_key{0} == '&') ?
-                               "/(<[^>]*>)|($pattern)/" :
-                               "/(<[^>]*>|&(?:#[0-9]+|#x[0-9a-f]+|[0-9a-zA-Z]+);)|($pattern)/";
+                       $pattern = "/(<[^>]*>)|($pattern)/";
                        $callback = create_function(
                                '$arr',
                                'return $arr[1] ? $arr[1] : "<strong class=\"word'.$id++.'\">{$arr[2]}</strong>";'