To disable injection of content when javascript is desactivate do as follow:
In the file classes/ajaxSearch.class.inc.php around line 629, replace the line:
$this->varLayout['inputValue'] = ($this->searchString == '' && $this->_lang['as_boxText'] != '') ? $this->_lang['as_boxText'] : $this->searchString;by
$this->varLayout['inputValue'] = ((!$validSearch) || (($this->searchString == '') && ($this->_lang['as_boxText'] != ''))) ? $this->_lang['as_boxText'] : $this->searchString;
Let me know if injection is still possible.
Bug registered as
AJAXSEARCH-46
This fix will be part of the next release of AjaxSearch.
