- document root is owned by root and not writable by www-data
(the base image ships /var/www/html as www-data with mode 1777)
- uses php.ini-production, so errors are not shown to clients
- disables directory listings, expose_php and the detailed server signature
Nominatim results were inserted via innerHTML and loaded as a JSONP script
with an unencoded query. Results are now fetched as JSON, the query is URL
encoded, text is escaped and coordinates must be numeric.
camera.php built its JSON by hand with htmlentities(), which leaves
backslashes intact, and the client parsed it with eval() and inserted tag
values into the popup as HTML. A tag value such as <img ...> therefore
became live markup (stored XSS for anyone able to edit OSM data), and a lone
backslash broke parsing of the whole response.
- camera.php now builds the response with json_encode() and returns raw values
- tags named lat, lon, id, count, multi or poly no longer override the
fields set by the server
- error responses no longer include database error messages
- the client uses JSON.parse() and escapes all keys and values; only
http(s) URLs are rendered as links/images
