From ae85ceca1e6c579db0f922077cd36c91261e2874 Mon Sep 17 00:00:00 2001 From: Sarah Hoffmann Date: Sat, 2 May 2020 21:54:14 +0200 Subject: [PATCH] properly escape class parameter The class parameter was used as is, allowing for potential SQL injection via the API. Thanks to @bladeswords for finding this. --- website/details.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/website/details.php b/website/details.php index cb371e6b..04673364 100644 --- a/website/details.php +++ b/website/details.php @@ -32,12 +32,14 @@ $sLanguagePrefArraySQL = $oDB->getArraySQL($oDB->getDBQuotedList($aLangPrefOrder if ($sOsmType && $iOsmId > 0) { $sSQL = 'SELECT place_id FROM placex WHERE osm_type = :type AND osm_id = :id'; + $aSQLParams = array(':type' => $sOsmType, ':id' => $iOsmId); // osm_type and osm_id are not unique enough if ($sClass) { - $sSQL .= " AND class='".$sClass."'"; + $sSQL .= ' AND class= :class'; + $aSQLParams[':class'] = $sClass; } $sSQL .= ' ORDER BY class ASC'; - $sPlaceId = $oDB->getOne($sSQL, array(':type' => $sOsmType, ':id' => $iOsmId)); + $sPlaceId = $oDB->getOne($sSQL, $aSQLParams); // Be nice about our error messages for broken geometry