Opened 16 years ago

Closed 16 years ago

#2488 closed defect (wontfix)

Specifying FILTER via URL is not enabled

Reported by: tamas Owned by: sdlime
Priority: normal Milestone: 5.0.3 release
Component: MapServer CGI Version: 5.0
Severity: normal Keywords:
Cc:

Description

Currently I cannot use &map.layer[0]=FILTER+myfilter+END

in the URL specification because of the missing maplexer definition

<INITIAL,URL_STRING>filter {return (FILTER);}

Change History (6)

comment:1 by tamas, 16 years ago

Milestone: 5.2 release5.0.3 release

comment:2 by sdlime, 16 years ago

Status: newassigned

Think this is purposeful as filters are passed directly do the underlying data source, often PostGIS, so this would be a big security hole. PostGIS does no validation. I need to look at the code though and see if I put some requirements about validation filters in place to mitigate this.

Steve

comment:3 by dmorissette, 16 years ago

Whatever we do I don't think this fits in the scope of a bugfix release... I suggest we push this one to 5.2

comment:4 by tamas, 16 years ago

May I consider the run-time substitution as a possible alternative of this, or has it got some limitation with respect to the filter parameter?

comment:5 by sdlime, 16 years ago

That's the workaround for setting an expression too. The runtime substitutions do have the option of setting a regex to validate the variable value against. That will work for filters as well. I think we can mark this as WONTFIX if that's ok with you.

Steve

comment:6 by sdlime, 16 years ago

Resolution: wontfix
Status: assignedclosed

Marking as WONTFIX since the behavior is intentional and there is a workaround...

Steve

Note: See TracTickets for help on using tickets.