Filtering Bug (PHP Code Passed) #5178

New issue

Open

opened 2026-02-20 16:30:59 -05:00 by deekerman · 1 comment

deekerman commented

2026-02-20 16:30:59 -05:00

Owner

Originally created by @juncelcarreon on GitHub (Mar 28, 2024).

Issue

I was copy pasting some PHP data beforehand and was trying to search for a Lead afterwards.

I was copying a lead name and immediately entered to search. What I checked by the time that it was already loading trying to search, is that in the input field the one that I copied is actually the PHP data I tried to copy beforehand

Expected Behavior

The behavior should have been this:

Actual Behavior

The PHP Code that I accidentally copied is now the ones showing on the Lead List View Page.

Possible Fix

For now the way I restored it is just use this URL:
http://mycrm.com/index.php?action=index&module=Leads&searchFormTab=advanced_search&query=true&clear_query=true

Steps to Reproduce

Goto any Module (Mine is the Leads)
Click on the Filter
Copy a certain code (Mine is a PHP Code)

Context

I believe this is just a rarity (I think). Not really affecting me that much since I found a solution to reset it.

Your Environment

SuiteCRM Version used: 7.11.21
Browser name and version (e.g. Chrome Version 51.0.2704.63 (64-bit)): Chrome
Environment name and version (e.g. MySQL, PHP 7): 7.4.27
Operating System and version (e.g Ubuntu 16.04): CentOs 7

Originally created by @juncelcarreon on GitHub (Mar 28, 2024).     #### Issue   I was copy pasting some PHP data beforehand and was trying to search for a Lead afterwards. I was copying a lead name and immediately entered to search. What I checked by the time that it was already loading trying to search, is that in the input field the one that I copied is actually the PHP data I tried to copy beforehand #### Expected Behavior  The behavior should have been this: ![image](https://github.com/salesagility/SuiteCRM/assets/116038186/ab5ef18f-b47d-4b61-afa0-0c27284e4222) #### Actual Behavior   The PHP Code that I accidentally copied is now the ones showing on the Lead List View Page. ![image](https://github.com/salesagility/SuiteCRM/assets/116038186/ec6118f5-8e7e-4ae5-8a4d-1812fb805e96) #### Possible Fix  For now the way I restored it is just use this URL: **_http://mycrm.com/index.php?action=index&module=Leads&searchFormTab=advanced_search&query=true&clear_query=true_** #### Steps to Reproduce   1. Goto any Module (Mine is the Leads) 2. Click on the Filter 3. Copy a certain code (Mine is a PHP Code) ![image](https://github.com/salesagility/SuiteCRM/assets/116038186/348c21e5-3a4d-4632-8aff-9be70015d1ac) #### Context   I believe this is just a rarity (I think). Not really affecting me that much since I found a solution to reset it. #### Your Environment  * SuiteCRM Version used: **7.11.21** * Browser name and version (e.g. Chrome Version 51.0.2704.63 (64-bit)): **Chrome** * Environment name and version (e.g. MySQL, PHP 7): **7.4.27** * Operating System and version (e.g Ubuntu 16.04): **CentOs 7**

deekerman added the

Type: Bug

Priority:Important

Severity: Major

Status: Team Investigating

Area:Search

labels

2026-02-20 16:30:59 -05:00

deekerman commented

2026-02-20 16:31:01 -05:00

Author

Owner

@chris001 commented on GitHub (Mar 28, 2024):

The code must sanitize the user input in the search box. This is required to fix this code injection vulnerability.

@chris001 commented on GitHub (Mar 28, 2024): The code must sanitize the user input in the search box. This is required to fix this code injection vulnerability.