don't trust words from word table to be sanatized

[nominatim.git] / lib / SearchDescription.php

diff --git a/lib/SearchDescription.php b/lib/SearchDescription.php
index a82852990e6f589f3bc57d9f2bd6c3f630c90ae9..42e5af309854b76967cc3079e35f32c0ceedae76 100644 (file)
--- a/lib/SearchDescription.php
+++ b/lib/SearchDescription.php
@@ -2,45 +2,7 @@
 
 namespace Nominatim;
 
-/**
- * Operators describing special searches.
- */
-abstract class Operator
-{
-    /// No operator selected.
-    const NONE = 0;
-    /// Search for POI of the given type.
-    const TYPE = 1;
-    /// Search for POIs near the given place.
-    const NEAR = 2;
-    /// Search for POIS in the given place.
-    const IN = 3;
-    /// Search for POIS named as given.
-    const NAME = 4;
-    /// Search for postcodes.
-    const POSTCODE = 5;
-
-    private $aConstantNames = null;
-
-    public static function toString($iOperator)
-    {
-        if ($iOperator == Operator::NONE) {
-            return '';
-        }
-
-        if ($aConstantNames === null) {
-            $oReflector = new \ReflectionClass ('Nominatim\Operator');
-            $aConstants = $oReflector->getConstants();
-
-            $aConstantNames = array();
-            foreach ($aConstants as $sName => $iValue) {
-                $aConstantNames[$iValue] = $sName;
-            }
-        }
-
-        return $aConstantNames[$iOperator];
-    }
-}
+require_once(CONST_BasePath.'/lib/SpecialSearchOperator.php');
 
 /**
  * Description of a single interpretation of a search query.
@@ -79,6 +41,7 @@ class SearchDescription
     /// Index of phrase currently processed
     private $iNamePhrase = -1;
 
+
     public function getRank()
     {
         return $this->iSearchRank;
@@ -95,9 +58,6 @@ class SearchDescription
         return $this->sPostcode;
     }
 
-    /**
-     * Set the geographic search radius.
-     */
     public function setNear(&$oNearPoint)
     {
         $this->oNearPoint = $oNearPoint;
@@ -110,26 +70,17 @@ class SearchDescription
         $this->sType = $sType;
     }
 
-    /**
-     * Check if name or address for the search are specified.
-     */
     public function isNamedSearch()
     {
         return sizeof($this->aName) > 0 || sizeof($this->aAddress) > 0;
     }
 
-    /**
-     * Check if only a country is requested.
-     */
     public function isCountrySearch()
     {
         return $this->sCountryCode && sizeof($this->aName) == 0
                && !$this->iOperator && !$this->oNearPoint;
     }
 
-    /**
-     * Check if a search near a geographic location is requested.
-     */
     public function isNearSearch()
     {
         return (bool) $this->oNearPoint;
@@ -179,13 +130,6 @@ class SearchDescription
         return $this->iOperator != Operator::NONE;
     }
 
-    /**
-     * Extract special terms from the query, amend the search
-     * and return the shortended query.
-     *
-     * Only the first special term found will be used but all will
-     * be removed from the query.
-     */
     public function extractKeyValuePairs($sQuery)
     {
         // Search for terms of kind [<key>=<value>].
@@ -225,6 +169,7 @@ class SearchDescription
 
     /////////// Search building functions
 
+
     public function extendWithFullTerm($aSearchTerm, $bWordInQuery, $bHasPartial, $sPhraseType, $bFirstToken, $bFirstPhrase, $bLastToken, &$iGlobalRank)
     {
         $aNewSearches = array();
@@ -256,7 +201,9 @@ class SearchDescription
             // We need to try the case where the postal code is the primary element
             // (i.e. no way to tell if it is (postalcode, city) OR (city, postalcode)
             // so try both.
-            if (!$this->sPostcode && $bWordInQuery) {
+            if (!$this->sPostcode && $bWordInQuery
+                && pg_escape_string($aSearchTerm['word']) == $aSearchTerm['word']
+            ) {
                 // If we have structured search or this is the first term,
                 // make the postcode the primary search element.
                 if ($this->iOperator == Operator::NONE
@@ -294,6 +241,9 @@ class SearchDescription
                 if (preg_match_all("/[^0-9]/", $oSearch->sHouseNumber, $aMatches) > 2) {
                     $oSearch->iSearchRank++;
                 }
+                if (!isset($aSearchTerm['word_id'])) {
+                    $oSearch->iSearchRank++;
+                }
                 // also must not appear in the middle of the address
                 if (sizeof($this->aAddress) || sizeof($this->aAddressNonSearch)) {
                     $oSearch->iSearchRank++;
@@ -322,7 +272,7 @@ class SearchDescription
                 }
 
                 $oSearch->setPoiSearch($iOp, $aSearchTerm['class'], $aSearchTerm['type']);
-                $aNewWordsetSearches[] = $oSearch;
+                $aNewSearches[] = $oSearch;
             }
         } elseif (isset($aSearchTerm['word_id']) && $aSearchTerm['word_id']) {
             $iWordID = $aSearchTerm['word_id'];
@@ -335,8 +285,7 @@ class SearchDescription
                     $oSearch->iSearchRank++;
                     $oSearch->aAddress[$iWordID] = $iWordID;
                     $aNewSearches[] = $oSearch;
-                }
-                else {
+                } else {
                     $this->aFullNameAddress[$iWordID] = $iWordID;
                 }
             } else {
@@ -393,7 +342,7 @@ class SearchDescription
                         $aNewSearches[] = $oSearch;
                     }
                 }
-            } 
+            }
         }
 
         if ((!$this->sPostcode && !$this->aAddress && !$this->aAddressNonSearch)
@@ -421,6 +370,7 @@ class SearchDescription
 
     /////////// Query functions
 
+
     public function queryCountry(&$oDB, $sViewboxSQL)
     {
         $sSQL = 'SELECT place_id FROM placex ';
@@ -490,7 +440,7 @@ class SearchDescription
 
     public function queryPostcode(&$oDB, $sCountryList, $iLimit)
     {
-        $sSQL  = 'SELECT p.place_id FROM location_postcode p ';
+        $sSQL = 'SELECT p.place_id FROM location_postcode p ';
 
         if (sizeof($this->aAddress)) {
             $sSQL .= ', search_name s ';
@@ -501,10 +451,10 @@ class SearchDescription
             $sSQL .= 'WHERE ';
         }
 
-        $sSQL .= "p.postcode = '".pg_escape_string(reset($this->$aName))."'";
+        $sSQL .= "p.postcode = '".reset($this->aName)."'";
         $sCountryTerm = $this->countryCodeSQL('p.country_code', $sCountryList);
         if ($sCountryTerm) {
-            $sSQL .= ' AND '.$sCountyTerm;
+            $sSQL .= ' AND '.$sCountryTerm;
         }
         $sSQL .= " LIMIT $iLimit";
 
@@ -592,7 +542,7 @@ class SearchDescription
         }
 
         if ($sViewboxSmall) {
-           $aTerms[] = 'centroid && '.$sViewboxSmall;
+            $aTerms[] = 'centroid && '.$sViewboxSmall;
         }
 
         if ($this->oNearPoint) {
@@ -895,7 +845,8 @@ class SearchDescription
 
     /////////// Sort functions
 
-    static function bySearchRank($a, $b)
+
+    public static function bySearchRank($a, $b)
     {
         if ($a->iSearchRank == $b->iSearchRank) {
             return $a->iOperator + strlen($a->sHouseNumber)
@@ -907,9 +858,12 @@ class SearchDescription
 
     //////////// Debugging functions
 
-    function dumpAsHtmlTableRow(&$aWordIDs)
+
+    public function dumpAsHtmlTableRow(&$aWordIDs)
     {
-        $kf = function($k) use (&$aWordIDs) { return $aWordIDs[$k]; };
+        $kf = function ($k) use (&$aWordIDs) {
+            return $aWordIDs[$k];
+        };
 
         echo "<tr>";
         echo "<td>$this->iSearchRank</td>";
@@ -934,4 +888,4 @@ class SearchDescription
 
         echo "</tr>";
     }
-};
+}