Re: sanizing/filtering query string for security

2009-11-10 Thread michael8
tta, Hadoop, HBase, UIMA, NLP, NER, IR > > > > - Original Message >> From: Alexey Serba >> To: solr-user@lucene.apache.org >> Sent: Mon, November 9, 2009 5:23:52 PM >> Subject: Re: sanizing/filtering query string for security >> >> >

Re: sanizing/filtering query string for security

2009-11-09 Thread Otis Gospodnetic
r-user@lucene.apache.org > Sent: Mon, November 9, 2009 5:23:52 PM > Subject: Re: sanizing/filtering query string for security > > > BTW, I have not used DisMax handler yet, but does it handle *:* properly? > See q.alt DisMax parameter > http://wiki.apache.org/solr/DisMaxRequestHandler#q.alt

Re: sanizing/filtering query string for security

2009-11-09 Thread Alexey Serba
> BTW, I have not used DisMax handler yet, but does it handle *:* properly? See q.alt DisMax parameter http://wiki.apache.org/solr/DisMaxRequestHandler#q.alt You can specify q.alt=*:* and q as empty string to get all results. > do you care if users issue this query I allow users to issue an empty

Re: sanizing/filtering query string for security

2009-11-09 Thread Otis Gospodnetic
9, 2009 4:59:33 PM > Subject: Re: sanizing/filtering query string for security > > > Sounds like a nice approach you have done. BTW, I have not used DisMax > handler yet, but does it handle *:* properly? IOW, do you care if users > issue this query, or does DisMax treat this qu

Re: sanizing/filtering query string for security

2009-11-09 Thread michael8
Sounds like a nice approach you have done. BTW, I have not used DisMax handler yet, but does it handle *:* properly? IOW, do you care if users issue this query, or does DisMax treat this query string differently than standard request handler? Basically given my UI, I'm trying to *hide* the tot

Re: sanizing/filtering query string for security

2009-11-09 Thread Alexey Serba
I added some kind of pre and post processing of Solr results for this, i.e. If I find fieldname specified in query string in form of "fieldname:term" then I pass this query string to standard request handler, otherwise use DisMaxRequestHandler ( DisMaxRequestHandler doesn't break the query, at lea

Re: sanizing/filtering query string for security

2009-11-09 Thread michael8
Hi Julian, Saw you post on exactly the question I have. I'm curious if you got any response directly, or figured out a way to do this by now that you could share? I'm in the same situation trying to 'sanitize' the query string coming in before handing it to solr. I do see that characters like