fixed saved search

src/entities/note.js

@@ -132,7 +132,7 @@ class Note extends Entity {
 
     /** @returns {boolean} true if the note has string content (not binary) */
     isStringNote() {
-        return ["text", "code", "relation-map"].includes(this.type) || this.mime.startsWith('text/');
+        return ["text", "code", "relation-map", "search"].includes(this.type) || this.mime.startsWith('text/');
     }
 
     /** @returns {string} JS script environment - either "frontend" or "backend" */

src/public/javascripts/services/note_detail_search.js

@@ -6,15 +6,11 @@ const $searchString = $("#search-string");
 const $component = $('#note-detail-search');
 const $refreshButton = $('#note-detail-search-refresh-results-button');
 
-function getContent() {
-    return JSON.stringify({
-        searchString: $searchString.val()
-    });
-}
-
 function show() {
     $component.show();
 
+    console.log(noteDetailService.getCurrentNote());
+
     try {
         const json = JSON.parse(noteDetailService.getCurrentNote().noteContent.content);
 
@@ -28,6 +24,12 @@ function show() {
     $searchString.on('input', noteDetailService.noteChanged);
 }
 
+function getContent() {
+    return JSON.stringify({
+        searchString: $searchString.val()
+    });
+}
+
 $refreshButton.click(async () => {
     await noteDetailService.saveNoteIfChanged();
 

src/public/javascripts/services/tree_builder.js

@@ -126,7 +126,9 @@ async function prepareRealBranch(parentNote) {
 
 async function prepareSearchBranch(note) {
     const fullNote = await noteDetailService.loadNote(note.noteId);
-    const results = (await server.get('search/' + encodeURIComponent(fullNote.jsonContent.searchString)))
+    const json = JSON.parse(fullNote.noteContent.content);
+
+    const results = (await server.get('search/' + encodeURIComponent(json.searchString)))
         .filter(res => res.noteId !== note.noteId); // this is necessary because title of the search note is often the same as the search text which would match and create circle
 
     // force to load all the notes at once instead of one by one

src/routes/api/search.js

@@ -1,6 +1,7 @@
 "use strict";
 
 const sql = require('../../services/sql');
+const utils = require('../../services/utils');
 const noteService = require('../../services/notes');
 const noteCacheService = require('../../services/note_cache');
 const parseFilters = require('../../services/parse_filters');
@@ -55,15 +56,18 @@ async function getFullTextResults(searchText) {
     const tokenSql = ["1=1"];
 
     for (const token of tokens) {
-        // FIXME: escape token!
-        tokenSql.push(`(title LIKE '%${token}%' OR content LIKE '%${token}%')`);
+        const safeToken = utils.sanitizeSql(token);
+
+        tokenSql.push(`(title LIKE '%${safeToken}%' OR content LIKE '%${safeToken}%')`);
     }
 
     const noteIds = await sql.getColumn(`
       SELECT DISTINCT noteId 
-      FROM notes 
+      FROM 
+        notes
+        JOIN note_contents USING(noteId)
       WHERE isDeleted = 0 
-        AND isProtected = 0
+        AND notes.isProtected = 0
         AND type IN ('text', 'code')
         AND ${tokenSql.join(' AND ')}`);