safety-screen/Nominatim
1
0
Fork 0
forked from hans/Nominatim
Code Pull Requests Activity

properly escape class parameter

Browse Source 
The class parameter was used as is, allowing for potential
SQL injection via the API.

Thanks to @bladeswords for finding this.
This commit is contained in:
Sarah Hoffmann
2020-05-02 21:54:14 +02:00
parent e4ecbef61e
commit 51f6db2e9c
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
website/details.php
View File

@@ -32,12 +32,14 @@ $sLanguagePrefArraySQL = $oDB->getArraySQL($oDB->getDBQuotedList($aLangPrefOrder
if ($sOsmType && $iOsmId > 0) {
$sSQL = 'SELECT place_id FROM placex WHERE osm_type = :type AND osm_id = :id';
$aSQLParams = array(':type' => $sOsmType, ':id' => $iOsmId);
// osm_type and osm_id are not unique enough
if ($sClass) {
$sSQL .= " AND class='".$sClass."'";
$sSQL .= ' AND class= :class';
$aSQLParams[':class'] = $sClass;
}
$sSQL .= ' ORDER BY class ASC';
$sPlaceId = $oDB->getOne($sSQL, array(':type' => $sOsmType, ':id' => $iOsmId));
$sPlaceId = $oDB->getOne($sSQL, $aSQLParams);
// Be nice about our error messages for broken geometry