Fix to prevent JavaScript injection in Custom Google Search (v1.2) WordPress plugin

custom-google-search.php-xss-fix.patch

--- custom-google-search.php.orig       2014-03-13 15:37:59.185879551 -0500
+++ custom-google-search.php    2014-03-13 15:38:43.309881189 -0500
@@ -195,7 +195,7 @@
         if ( isset( $args['search_text'] ) )
             $search_text = '
                 ///run search by query
-                customSearchControl.execute("' . $_REQUEST['s'] . '");';
+                customSearchControl.execute("' . get_search_query() . '");';
         else
             $search_text = '';

@@ -330,9 +330,8 @@

         $arg = array();

-        if ( isset( $_REQUEST['s'] ) && '' != $_REQUEST['s'] )
             $args = array(
-                'search_text' => $_REQUEST['s']
+                'search_text' => get_search_query()
             );

         $search_box = $this->generate_search_box( $args );