I am basically using a form disguised as a "Top button" on the subpanel. Which is why this only works if you DO NOT have the fancy buttons on subpanels. 
This was a downside I had not anticipated when this was developed in 6.2.2 and I've not found a workaround to keep it out of the button dropdown with fancy buttons on. 


thanks, 
Francesca 


----- Original Message -----

From: "Sugared" <notifications@github.com> 
To: "sugarcrm/sugarcrm_dev" <sugarcrm_dev@noreply.github.com> 
Cc: "Francesca Shiekh" <francescas@wolfram.com> 
Sent: Friday, April 5, 2013 3:23:42 PM 
Subject: Re: [sugarcrm_dev] SubPanelFilter (#136) 


In include/SubPanel/filter_subpanel.php: > +$table_name = $subpanelDef->table_name;
> +
> +// create or append subpanel definition where clause for the filter
> +
> +if (!isset($subpanelDef->panel_definition['where']) || $subpanelDef->panel_definition['where'] == '') {
> +    $subpanelDef->panel_definition['where'] = '';
> +} else {
> +    $subpanelDef->panel_definition['where'] .= ' AND ';
> +}
> +
> +if ($_REQUEST['search_params'] && $_REQUEST['search_params'] != '' && $table_name != '') {
> +    if($table_name == 'contacts') {
> +        $subpanelDef->panel_definition['where'] .= " " . $table_name . ".first_name like '%" . trim($_REQUEST['search_params']) . "%' OR " . $table_name . ".last_name like '%" . trim($_REQUEST['search_params']) . "%'";
> +    } else {
> +        $subpanelDef->panel_definition['where'] .= " " . $table_name . ".name like '%" . trim($_REQUEST['search_params']) . "%' ";
> +    } 
I'm not clear how the search_params element is being populated from the UI, but do you think this is a possible point for a sql injection attack? We might need to clean up the string before using it to build a query, perhaps something like: 

trim($GLOBALS['db']->quote($_REQUEST['search_params'])); 
— 
Reply to this email directly or view it on GitHub .