CCCHH/sunders
CCCHH/sunders
Watch
3
0
Fork
You've already forked sunders
 1
forked from kamba4/sunders
Code Issues 6 Pull requests Packages 1 Activity Actions

fix: Escapes generated SQL and validates sequence number

Browse source 
create_camera_update_statements.php wrote OSM tag keys and values unescaped
into /migrations/*.sql. Values are now escaped and node ids cast to int.
The sequence number argument must be numeric and is bound as a parameter
instead of being concatenated into SQL and the output path.
This commit is contained in:
Stefan Bethke 2026-11-15 11:36:49 +01:00
commit 3b28280333
1 changed files with 37 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

12
data_handler/utils/update_camera.php
View file

@ -2,6 +2,12 @@
include "config.php";
$seqNum = $_SERVER['argv'][1] ?? '';
if (!ctype_digit($seqNum)) {
echo "Invalid sequence number\n";
exit(1);
}
$elementTypes = array();
$count = 0;
$countDelete = 0;
@ -281,8 +287,10 @@ while ($data = fread($fp, 4096)) {
}
}
$sql="UPDATE sync_state SET v='" . $_SERVER['argv'][1] ."' WHERE k='sequenceNumber';";
$mysqli->query($sql);
$syncStmt = $mysqli->prepare("UPDATE sync_state SET v=? WHERE k='sequenceNumber'");
$syncStmt->bind_param('s', $seqNum);
$syncStmt->execute();
$syncStmt->close();
$mysqli->commit();
printDebug();