From 1e9939f06466f377ab2eaab71164b75570fec448 Mon Sep 17 00:00:00 2001
From: Cory Lown <cory.lown@duke.edu>
Date: Tue, 15 Jan 2019 13:42:46 -0500
Subject: [PATCH] Escape boost param for Solr.

---
 app/models/concerns/subjects_boost.rb | 15 ++++++++++++---
 lib/dul_argon_skin/version.rb         |  2 +-
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/app/models/concerns/subjects_boost.rb b/app/models/concerns/subjects_boost.rb
index f0ebaf6..efbd729 100644
--- a/app/models/concerns/subjects_boost.rb
+++ b/app/models/concerns/subjects_boost.rb
@@ -30,14 +30,23 @@ def subjects_english_boost_query
   def subjects_title_boost_query
     if blacklight_params.key?(:q) &&
        blacklight_params[:q].present?
-      "#{TrlnArgon::Fields::TITLE_MAIN_INDEXED}:(#{blacklight_params[:q]})^500"
+      standard_search_title_boost
     elsif blacklight_params.key?('subject') &&
           blacklight_params['subject'].present?
-      "#{TrlnArgon::Fields::TITLE_MAIN_INDEXED}:"\
-      "(#{blacklight_params['subject']})^500"
+      advanced_search_title_boost
     end
   end
 
+  def standard_search_title_boost
+    "#{TrlnArgon::Fields::TITLE_MAIN_INDEXED}:"\
+    "(#{RSolr.solr_escape(blacklight_params[:q])})^500"
+  end
+
+  def advanced_search_title_boost
+    "#{TrlnArgon::Fields::TITLE_MAIN_INDEXED}:"\
+    "(#{RSolr.solr_escape(blacklight_params['subject'])})^500"
+  end
+
   def includes_subject_search?
     blacklight_params.key?('search_field') &&
       ((blacklight_params['search_field'] == 'subject' ||
diff --git a/lib/dul_argon_skin/version.rb b/lib/dul_argon_skin/version.rb
index 888815b..a8497e7 100644
--- a/lib/dul_argon_skin/version.rb
+++ b/lib/dul_argon_skin/version.rb
@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DulArgonSkin
-  VERSION = '1.0.2'
+  VERSION = '1.0.3'
 end