Escape user input before building regexps

app/controllers/client_managements_controller.rb

@@ -82,12 +82,12 @@ class ClientManagementsController < CPanelController
 
   def site_tickets
     if params[:category].present? && params[:keyword].present?
-      regex = ::Regexp.new(".*" + params[:keyword] + ".*", "i") 
+      regex = ::Regexp.new(".*" + Regexp.escape(params[:keyword].to_s) + ".*", "i") 
       @tickets = @site_construct.tickets.where(:category_id => params[:category], :subject => regex).order_by([:status, :desc],[:created_at, :desc]).page(params[:page]).per(10)
     elsif params[:category].present?
       @tickets = @site_construct.tickets.where(:category_id => params[:category]).order_by([:status, :desc],[:created_at, :desc]).page(params[:page]).per(10)
     elsif params[:keyword].present?
-      regex = ::Regexp.new(".*" + params[:keyword] + ".*", "i") 
+      regex = ::Regexp.new(".*" + Regexp.escape(params[:keyword].to_s) + ".*", "i") 
       @tickets = @site_construct.tickets.where(:subject => regex).order_by([:status, :desc],[:created_at, :desc]).page(params[:page]).per(10)
     else
       @tickets = @site_construct.tickets.order_by([:status, :desc],[:created_at, :desc]).page(params[:page]).per(10)