Escape user input before building regexps

app/controllers/admin/tickets_api_controller.rb

@@ -86,7 +86,7 @@ class Admin::TicketsApiController < ApplicationController
 				t = params[:type]
 				case t
 				when "text"
-					regex = Regexp.new(".*"+q+".*", "i")
+					regex = Regexp.new(".*"+Regexp.escape(q.to_s)+".*", "i")
 					site_tickets = site.tickets.where(:subject => regex).desc(:created_at).page(params[:page]).per(25)
 				when "number"
 					site_tickets = site.tickets.where(:uid => q).desc(:created_at).page(params[:page]).per(25)

app/controllers/admin/tickets_manage_controller.rb

@@ -266,7 +266,7 @@ class Admin::TicketsManageController < OrbitAdminController
         when "text"
           @tickets = Ticket.where(:category_id => @category.id, :status.in => statuses).order_by(sort)
           @tickets = search_data(@tickets,[:subject, :uid, :status, :site_type, :ticket_creater_id, :ticket_creater_name])
-          regex = Regexp.new(".*"+keywords+".*", "i")
+          regex = Regexp.new(".*"+Regexp.escape(keywords.to_s)+".*", "i")
           sites = RegisteredSite.any_of({:title => regex},{:site_domain => regex})
           sites.each do |site|
             @tickets = (@tickets | site.tickets.where(:category_id => @category.id, :status.in => statuses))
@@ -305,7 +305,7 @@ class Admin::TicketsManageController < OrbitAdminController
     when "text"
       tickets = Ticket.where(:status.in => statuses)
       tickets = search_data(tickets,[:subject, :uid, :status, :site_type, :ticket_creater_id, :ticket_creater_name])
-      regex = Regexp.new(".*"+keywords+".*", "i")
+      regex = Regexp.new(".*"+Regexp.escape(keywords.to_s)+".*", "i")
       sites = RegisteredSite.any_of({:title => regex},{:site_domain => regex})
       sites.each do |site|
         tickets = (tickets | site.tickets.where(:status.in => statuses))
@@ -328,7 +328,7 @@ class Admin::TicketsManageController < OrbitAdminController
   def smart_search(statuses, category = nil, smart_field, keywords)
     keywords = keywords.strip.nil? ? keywords : keywords.strip
     regexes = keywords.split(/\s+(?=(?:[^"]*"[^"]*")*[^"]*$)/)
-    regex = Regexp.union(regexes.map{|word| Regexp.new(".*"+word+".*", "i")})
+    regex = Regexp.union(regexes.map{|word| Regexp.new(".*"+Regexp.escape(word)+".*", "i")})
     tickets = []
     case smart_field
     when "sitename:"