<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=NO-BOK link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-US>Hi there, mailing list,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>We have a customer sending us data with sensitive information. The most convenient way for us is to receive the complete data set and applying a filter in the mapfile.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>The layer definition looks like this:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>LAYER<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> NAME Traseer<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> GROUP TelMe<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> TYPE LINE<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> </span>DATA "TM_Nett/TM_Traces"<o:p></o:p></p><p class=MsoNormal> FILTER('[type]' != "Bru")<o:p></o:p></p><p class=MsoNormal> #Styling and more etc....<o:p></o:p></p><p class=MsoNormal>END<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-US>This works flawlessly using PHP Mapscript and the mapserver WMS service. The data is not accessible. The problem occurs when querying by WFS. The Mapserver WFS service seems to omit the FILTER information and opens up for selecting items with the type “Bru”, which is a serious security flaw. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>I’d consider this as a bug, although I’m not certain. If anyone please can confirm this, or show me how to make mapserver filter data in WFS as well, I’d be much obliged.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Best Regards,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Håkon<o:p></o:p></span></p></div></body></html>