From 590cde783fb909be9f46df178b43ced11ac1d9fe Mon Sep 17 00:00:00 2001
From: Leo Feyer <github@contao.org>
Date: Mon, 17 Mar 2014 20:32:21 +0100
Subject: [PATCH] Correctly handle OR queries in the listing module (see #6344)

---
 system/docs/CHANGELOG.md                         | 3 +++
 system/modules/listing/dca/tl_module.php         | 4 ++--
 system/modules/listing/modules/ModuleListing.php | 7 ++++---
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/system/docs/CHANGELOG.md b/system/docs/CHANGELOG.md
index e5984578d4..004cdc2e8a 100644
--- a/system/docs/CHANGELOG.md
+++ b/system/docs/CHANGELOG.md
@@ -4,6 +4,9 @@ Contao Open Source CMS changelog
 Version 3.2.9 (2014-XX-XX)
 --------------------------
 
+### Fixed
+Correctly handle OR queries in the listing module (see #6344).
+
 ### Fixed
 Use a monospaced font for the plain text newsletter preview (see #6790).
 
diff --git a/system/modules/listing/dca/tl_module.php b/system/modules/listing/dca/tl_module.php
index 553d5f05d2..4b63131f08 100644
--- a/system/modules/listing/dca/tl_module.php
+++ b/system/modules/listing/dca/tl_module.php
@@ -53,7 +53,7 @@
 	'label'                   => &$GLOBALS['TL_LANG']['tl_module']['list_search'],
 	'exclude'                 => true,
 	'inputType'               => 'text',
-	'eval'                    => array('maxlength'=>255, 'tl_class'=>'w50'),
+	'eval'                    => array('decodeEntities'=>true, 'maxlength'=>255, 'tl_class'=>'w50'),
 	'sql'                     => "varchar(255) NOT NULL default ''"
 );
 
@@ -71,7 +71,7 @@
 	'label'                   => &$GLOBALS['TL_LANG']['tl_module']['list_info'],
 	'exclude'                 => true,
 	'inputType'               => 'text',
-	'eval'                    => array('maxlength'=>255, 'tl_class'=>'w50'),
+	'eval'                    => array('decodeEntities'=>true, 'maxlength'=>255, 'tl_class'=>'w50'),
 	'sql'                     => "varchar(255) NOT NULL default ''"
 );
 
diff --git a/system/modules/listing/modules/ModuleListing.php b/system/modules/listing/modules/ModuleListing.php
index eacb01080c..f6bdcd4152 100644
--- a/system/modules/listing/modules/ModuleListing.php
+++ b/system/modules/listing/modules/ModuleListing.php
@@ -80,6 +80,7 @@ public function generate()
 
 		$this->strTemplate = $this->list_layout;
 		$this->list_where = $this->replaceInsertTags($this->list_where);
+		$this->list_info_where = $this->replaceInsertTags($this->list_info_where);
 
 		return parent::generate();
 	}
@@ -137,7 +138,7 @@ protected function compile()
 
 		if ($this->list_where)
 		{
-			$strQuery .= " WHERE " . $this->list_where;
+			$strQuery .= " WHERE (" . $this->list_where . ")";
 		}
 
 		$strQuery .=  $strWhere;
@@ -177,7 +178,7 @@ protected function compile()
 
 		if ($this->list_where)
 		{
-			$strQuery .= " WHERE " . $this->list_where;
+			$strQuery .= " WHERE (" . $this->list_where . ")";
 		}
 
 		$strQuery .=  $strWhere;
@@ -366,7 +367,7 @@ protected function listSingleRecord($id)
 		$this->list_info = deserialize($this->list_info);
 		$this->list_info_where = $this->replaceInsertTags($this->list_info_where);
 
-		$objRecord = $this->Database->prepare("SELECT " . $this->list_info . " FROM " . $this->list_table . " WHERE " . (($this->list_info_where != '') ? $this->list_info_where . " AND " : "") . $this->strPk . "=?")
+		$objRecord = $this->Database->prepare("SELECT " . $this->list_info . " FROM " . $this->list_table . " WHERE " . (($this->list_info_where != '') ? "(" . $this->list_info_where . ") AND " : "") . $this->strPk . "=?")
 									->limit(1)
 									->execute($id);