diff --git a/classes/api.php b/classes/api.php index 96d3947ec..cd140172c 100644 --- a/classes/api.php +++ b/classes/api.php @@ -2,7 +2,7 @@ class API extends Handler { - const API_LEVEL = 1; + const API_LEVEL = 2; const STATUS_OK = 0; const STATUS_ERR = 1; @@ -170,9 +170,15 @@ class API extends Handler { $include_attachments = (bool)db_escape_string($_REQUEST["include_attachments"]); $since_id = (int)db_escape_string($_REQUEST["since_id"]); + /* do not rely on params below */ + + $search = db_escape_string($_REQUEST["search"]); + $search_mode = db_escape_string($_REQUEST["search_mode"]); + $match_on = db_escape_string($_REQUEST["match_on"]); + $headlines = api_get_headlines($this->link, $feed_id, $limit, $offset, $filter, $is_cat, $show_excerpt, $show_content, $view_mode, false, - $include_attachments, $since_id); + $include_attachments, $since_id, $search, $search_mode, $match_on); print $this->wrap(self::STATUS_OK, $headlines); } else { diff --git a/include/functions.php b/include/functions.php index e35d7c1c6..f0b90b6f6 100644 --- a/include/functions.php +++ b/include/functions.php @@ -4388,13 +4388,8 @@ function api_get_headlines($link, $feed_id, $limit, $offset, $filter, $is_cat, $show_excerpt, $show_content, $view_mode, $order, - $include_attachments, $since_id) { - - /* do not rely on params below */ - - $search = db_escape_string($_REQUEST["search"]); - $search_mode = db_escape_string($_REQUEST["search_mode"]); - $match_on = db_escape_string($_REQUEST["match_on"]); + $include_attachments, $since_id, + $search = "", $search_mode = "", $match_on = "") { $qfh_ret = queryFeedHeadlines($link, $feed_id, $limit, $view_mode, $is_cat, $search, $search_mode, $match_on,