From f94828c3f4ffa375943171aa921e3c5bc095d4f4 Mon Sep 17 00:00:00 2001
From: Sarah Hoffmann <lonvia@denofr.de>
Date: Sat, 2 May 2020 21:54:14 +0200
Subject: [PATCH] properly escape class parameter

The class parameter was used as is, allowing for potential
SQL injection via the API.

Thanks to @bladeswords for finding this.
---
 website/details.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/website/details.php b/website/details.php
index 39fa0afa..6f7c807d 100644
--- a/website/details.php
+++ b/website/details.php
@@ -37,12 +37,14 @@ if ($sOutputFormat == 'html' && !$sPlaceId && !$sOsmType) {
 
 if ($sOsmType && $iOsmId > 0) {
     $sSQL = 'SELECT place_id FROM placex WHERE osm_type = :type AND osm_id = :id';
+    $aSQLParams = array(':type' => $sOsmType, ':id' => $iOsmId);
     // osm_type and osm_id are not unique enough
     if ($sClass) {
-        $sSQL .= " AND class='".$sClass."'";
+        $sSQL .= ' AND class= :class';
+        $aSQLParams[':class'] = $sClass;
     }
     $sSQL .= ' ORDER BY class ASC';
-    $sPlaceId = $oDB->getOne($sSQL, array(':type' => $sOsmType, ':id' => $iOsmId));
+    $sPlaceId = $oDB->getOne($sSQL, $aSQLParams);
 
 
     // Nothing? Maybe it's an interpolation.
-- 
2.39.5