Re: Lucene code injection?

2007-05-24 Thread Joe
Hi, Hi Joe, It might be possible when you append the restriction before parsing the user query with the QueryParser, but I'm not sure. I recommend first parsing the query, and then constructing a BooleanQuery with the parsed user query and the e-mail term both as must. yes thats the idea. An

Re: Lucene code injection?

2007-05-24 Thread Joe
Damien McCarthy schrieb: Hi Joe, It would probably be cleaner to use a QueryFilter rather than doing the AND. Take a look at http://lucene.apache.org/java/2_0_0/api/org/apache/lucene/search/QueryFilter .html ok if its not to slow i go this way. Also I'm not sure that using the sent to fiel

RE: Lucene code injection?

2007-05-24 Thread Damien McCarthy
this, where their own email does not appear in that field. They could also have email auto forwarded from another address. Anyway hope this helps Damien -Original Message- From: Joe [mailto:[EMAIL PROTECTED] Sent: 24 May 2007 14:14 To: java-user@lucene.apache.org Subject: Re: Lucene

RE: Lucene code injection?

2007-05-24 Thread Daan de Wit
-user@lucene.apache.org Subject: Re: Lucene code injection? Hi, > This sounds good. As for the code injection it is up to you to sanitize > the request before it goes to lucene, probably by filling the email > field yourself and not rely on the user input for the email address I hoped i havent to san

Re: Lucene code injection?

2007-05-24 Thread Joe
Hi, This sounds good. As for the code injection it is up to you to sanitize the request before it goes to lucene, probably by filling the email field yourself and not rely on the user input for the email address I hoped i havent to sanitize the user input cause the email address query is ANDed

RE: Lucene code injection?

2007-05-24 Thread Mordo, Aviran (EXP N-NANNATEK)
- From: Joe [mailto:[EMAIL PROTECTED] Sent: Thursday, May 24, 2007 8:35 AM To: java-user@lucene.apache.org Subject: Lucene code injection? Hi, I indexed emails. And now i want to restrict the search functionality for users so they only can search for emails to/from him. i know the email address

Lucene code injection?

2007-05-24 Thread Joe
Hi, I indexed emails. And now i want to restrict the search functionality for users so they only can search for emails to/from him. i know the email address of the user so my plan is to do it in the following way: The user enters some search parameters, they are combined in a query. This is a mi