[Geomoose-users] How do I specify a GET or POST in my serviceURL?

[Dan Little]

Hi Jim,

What's happening is that you're getting a "cross site scripting" error.

Here's some reading on Cross Site Scripting:
http://www.cgisecurity.com/articles/xss-faq.shtml
http://en.wikipedia.org/wiki/Cross-site_scripting

The gist:
GeoMOOSE is using the XMLHTTP object (AJAX) to read the results of the request because it needs to see if the  HTML has any XML "commands" in it for GeoMOOSE to process.  Since the site (http://156.98.2.251) is not the same as the one the page is running on, then you'll get a security error and the request will not be processed.

The solution(s):
1) Make the requests look the same using a IIS or Apache trick.  Both servers have the ability to do proxy-requests and responses.  Set up one for the WFS download service.
2) Use a "proxy" script.  This is a script of some-sort that sits on the same server as GeoMOOSE and allows it to download arbitrary pages.
3) Put GeoMOOSE on the same server as the WFS servlet script.

-Duck

----- Original Message ----
From: Jim Dickerson <Jim.Dickerson at state.mn.us>
To: Dan Little <danlittle at yahoo.com>
Sent: Friday, October 19, 2007 1:30:52 PM
Subject: RE: [Geomoose-users] How do I specify a GET or POST in my serviceURL?




 
DIV {
MARGIN:0px;}



I'm trying to add a tool to the toolbar that sends a 
request to a servlet.  Here's my service entry:

  <service title="WFS Download"  
invisible="true" default="true" locked="true" 
icon="shared/images/toolbar/WFS_download.jpg" 
highlight="shared/images/toolbar/WFS_download_selected.jpg" 
selectable="false">
        
<url>http://156.98.2.251/servlet/requestWFSstreamG?</url>
  
</service>


When executed, I get this error: 

 uncaught exception: 
Permission denied to call method XMLHttpRequest.open



getHTTPObject()GeoMOOSE.js (line 272)

callService(service)GeoMOOSE.js (line 892)

triggerEvent("callservice", 
service)GeoMOOSE.js (line 320)

onclick()GeoMOOSE.js (line 844)

renderDefault("content_service_form")GeoMOOSE.js (line 847)

setParent("content_service_form")GeoMOOSE.js (line 809)

renderServiceForm(service)GeoMOOSE.js (line 854)

serviceForm(service)GeoMOOSE.js (line 877)

(no name)(service)statedemo.html (line 552)

triggerEvent("serviceform", 
service)GeoMOOSE.js (line 320)

onclickCallService()GeoMOOSE.js (line 765)

onclickServiceLink()GeoMOOSE.js (line 
764)


 

I'm not trying to do an XMLHttpRequest, just a 
GET.  The type is suppposed to default to POST/GET encoding so why is it 
trying to use XMLHttpRequest?

 

Jim







From: 
geomoose-users-bounces at lists.sourceforge.net 
[mailto:geomoose-users-bounces at lists.sourceforge.net] On Behalf Of Dan 
Little
Sent: Thursday, October 18, 2007 6:22 PM
To: Jim 
Dickerson; geomoose-users at lists.sourceforge.net
Subject: Re: 
[Geomoose-users] How do I specify a GET or POST in my 
serviceURL?






Jim, the 
message will be sent as a get or post automatically depending on the length of 
the request.


----- 
Original Message ----
From: Jim Dickerson 
<Jim.Dickerson at state.mn.us>
To: 
geomoose-users at lists.sourceforge.net
Sent: Thursday, October 18, 2007 5:50:58 
PM
Subject: [Geomoose-users] How do I specify a GET or POST in my service 
URL?

When using the <url> tag, what determines whether it is a GET 
or POST?
Does the use of <input> tags imply one or the other?  Are 
<input> tags
used with both?

Jim 
Dickerson

-------------------------------------------------------------------------
This 
SF.net email is sponsored by: Splunk 
Inc.
Still grepping through log files to find problems?  Stop.
Now 
Search log events and configuration files using AJAX and a browser.
Download 
your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Geomoose-users 
mailing list
Geomoose-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/geomoose-users





__________________________________________________
Do 
You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around 

http://mail.yahoo.com 




__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.osgeo.org/pipermail/geomoose-users/attachments/20071023/b4a972e0/attachment.html