<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Steve,</p>
<p>Regarding modes, what would we do regarding OWS requests (I mean
WMS, WCS, etc.) ? Would that be a mode that needs to be explicitly
enabled ? I see in mapservutil.c that modeStrings[] contains OWS
and WFS strings (which aren't documented in
<a class="moz-txt-link-freetext" href="https://mapserver.org/fr/cgi/controls.html">https://mapserver.org/fr/cgi/controls.html</a>), but if the incoming
request doesn't contain explicit MODE=OWS or MODE=WFS query
parameters, mode filtering will not be triggered.</p>
<p>I haven't understood what you meant with "immutable validation
value" and what would change. Some example might be useful.<br>
</p>
<p>Even<br>
</p>
<div class="moz-cite-prefix">Le 17/05/2021 à 19:58, Steve Lime a
écrit :<br>
</div>
<blockquote type="cite"
cite="mid:CAMrKZ99T=FsabqzfjrCH2MnQHERsGWHj7tH6c=7aWSKLW6aPDQ@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">Hi all: MapServer has a number of ways to
enable/disable CGI-based functionality. For example the <i>ows_enable_request</i>
metadata (RFC 67), the <i>ms_enable_modes</i> metadata (RFC
90) or the immutable validation value associated with runtime
changes (RFC 44). The latter doesn't seem to be particularly
well documented so folks probably don't know it's possible. Of
these methods, only ows_enable_request requires users to opt in
- you have to explicitly allow OWS services. The other methods
require users to opt out. I think we should think about changing
that in 8.0 and require explicit configuration by default, so:
<div>
<ol>
<li>Require <i>ms_enable_modes</i> be set before handling
native MapServer CGI requests or at least set a
more limited default than all modes.</li>
<li>Consider objects as immutable by default and require
users to explicitly configure that at the object-level by
adding. Would probably need to extend the VALIDATION block
to a few other objects such as scalebars, reference maps
and legends. The necessary changes are otherwise not
extensive.</li>
</ol>
Note that I consider run-time substitutions as already being
explicit since 1) validation is required and 2) users must
denote substitution strings as appropriate. Thoughts?</div>
<div><br>
</div>
<div>--Steve<br>
<div><br>
</div>
<div><br>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
mapserver-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:mapserver-dev@lists.osgeo.org">mapserver-dev@lists.osgeo.org</a>
<a class="moz-txt-link-freetext" href="https://lists.osgeo.org/mailman/listinfo/mapserver-dev">https://lists.osgeo.org/mailman/listinfo/mapserver-dev</a>
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
<a class="moz-txt-link-freetext" href="http://www.spatialys.com">http://www.spatialys.com</a>
My software is free, but my time generally not.</pre>
</body>
</html>