PDFPrint - printProxy security breach

[adube]

currently

In order to use the PDFPrint widget, you need to specify an alternative proxy file. This file is responsible of creating and processing the print requests.

issue

Unless I'm mistaken, the printProxy doesn't check if the layers specified inside the 'spec' parameter are authorized to access the according resources using the ACL. That would mean there is a security breach inside this widget.

solution

I see two solutions :

• we fix this issue in order to let the widget live

• we deprecate the widget and let the new upcoming print method take its place, see #147 and #148.

Before taking the final decision, I would like to add the following points (which all put weight towards the second solution) :

• this widget has been developed inside GeoPrisma only
• it currently supports 'wms' and 'tilecache' (only with wms access, i.e. no direct web cache access) services only. !The GeoExt ones support all of them.
• you need to manually define every templates, scales and dpis available in the template, which makes it complicate to configure when the new upcoming MapFishPrintService would do that automatically.

Comments would be welcomed.

[adube]

#76 should also be considered.

[adube]

#79 and #80 too.

[adube]

No patch, bumping to 1.2.

[adube]

No patch, moved to 1.4.

[belug]

No patch, moved to 1.6.

[adube]

No patch, moved to 1.8.