Changed from GET to POST on all parameter passing. Fixed a nasty bug in previous...

[hermes] / api / lib / user_functions.php

diff --git a/api/lib/user_functions.php b/api/lib/user_functions.php
index 5aa1cfbe113bcb3574989c6cb791d97c1cdbba66..a1a9b0c6ee3cd7fbcc0783d72d0ba0a59f7fc748 100644 (file)
--- a/api/lib/user_functions.php
+++ b/api/lib/user_functions.php
@@ -13,7 +13,7 @@ function generate_password( $length = 24 )
         while ( strlen( $string ) < $length )
         {
                $string .= crypt(substr(md5(rand().rand()), 0, $length+1));
-               $string = preg_replace( '/\W/', '', $string+1);
+               $string = preg_replace( '/\W/', '', $string);
         }
        return substr( $string, 1, $length );
 
@@ -240,9 +240,9 @@ function list_users ( $search = null )
        global $config;
        $query = sprintf("SELECT CONCAT(username, '@', domain), displayname FROM %s ORDER BY username,domain", $config['provision_users_table'] );
 
-       if ( array_key_exists ( 'search', $_GET ) )
+       if ( array_key_exists ( 'search', $_POST ) )
        {
-               $search = $_GET['search']; // TODO: Add some sanitation and input validation!
+               $search = $_POST['search']; // TODO: Add some sanitation and input validation!
                $query = sprintf("SELECT CONCAT(username, '@', domain) FROM %s WHERE CONCAT(username, '@', domain) LIKE '%%%s%%' ORDER BY username,domain", $config['provision_users_table'], sql_clean( $search ) );
        }