svn commit: r770 - trunk/mapbender/owsproxy/http/index.php

[uli at osgeo.org]

Author: uli
Date: 2006-09-26 11:26:23+0000
New Revision: 770

Modified:
   trunk/mapbender/owsproxy/http/index.php

Log:
validation of layer permissions included

Modified: trunk/mapbender/owsproxy/http/index.php
Url: https://mapbender.osgeo.org/source/browse/mapbender/trunk/mapbender/owsproxy/http/index.php?view=diff&rev=770&p1=trunk/mapbender/owsproxy/http/index.php&p2=trunk/mapbender/owsproxy/http/index.php&r1=769&r2=770
==============================================================================
--- trunk/mapbender/owsproxy/http/index.php	(original)
+++ trunk/mapbender/owsproxy/http/index.php	2006-09-26 11:26:23+0000
@@ -20,23 +20,29 @@
 
 /***** conf *****/
 $imageformats = array("image/png","image/gif","image/jpeg", "image/jpg");
+$mbkeys = array("sid",strtolower(ini_get("session.name")),"wms");
 /***** conf *****/
 
+$owskey = array();
 $myKeys = array_keys($_REQUEST);
 for($i=0; $i<count($myKeys); $i++){
 	$tmp[$i] = removeQM(strtolower($myKeys[$i]));
 	$$tmp[$i]  = $_REQUEST[$myKeys[$i]];
+	if(!in_array(removeQM(strtolower($myKeys[$i])),$mbkeys)){
+		$owskey[removeQM(strtolower($myKeys[$i]))] = $_REQUEST[$myKeys[$i]];
+	}
 }
 
 // check session
 session_id($_REQUEST["sid"]);
 session_start();
+
 if($_SESSION['mb_user_ip'] != $_SERVER['REMOTE_ADDR']){
 	throwE(array("No session data available.","Permission denied.","Please authenticate."));
 	die();	
 }
 
-// permission validieren
+// permission 
 $con = db_connect(DBSERVER,OWNER,PW);
 db_select_db(DB,$con);
 
@@ -66,16 +72,22 @@
 }
 
 /*************  prepare and send the response ************/
-$or = $n->checkURL($row["wms_getmap"]);
-$or = completeURL($or);
+
 switch (strtolower($request)) {
 	case 'getcapabilities':
+		$or = $n->checkURL($row["wms_getcapabilities"]);
+		$or = completeURL($or);
 		getCapabilities($or);
 		break;
 	case 'getfeatureinfo':
+		$or = $n->checkURL($row["wms_getfeatureinfo"]);
+		$or = completeURL($or);
 		getFeatureInfo($or);
 		break;
 	default:
+		$or = $n->checkURL($row["wms_getcapabilities"]);
+		$owskey["layers"] = checkLayerPermission($layers);
+		$or = completeURL($or);
 		getMap($or);
 }
 /*********************************************************/
@@ -114,14 +126,13 @@
 	if($format == 'image/gif'){imagegif($im);}	
 }
 function completeURL($url){
-	global $myKeys;
+	global $owskey;
 	$c = 0;
-	for($i=0; $i<count($myKeys); $i++){
-		if($myKeys[$i] != "wms" && $myKeys[$i] != "sid"){
-			if($c > 0){ $url .= "&"; }
-			$url .= removeQM($myKeys[$i])."=".$_REQUEST[$myKeys[$i]];
-			$c++;
-		}
+	while ($key = current($owskey)) {
+		if($c > 0){ $url .= "&"; }
+		$url .= key($owskey)."=".$key;
+		$c++;
+		next($owskey);
 	}
 	return $url;
 }
@@ -152,4 +163,16 @@
 	header("Content-Type: application/xml");
 	echo $r;
 }
+function checkLayerPermission($l){
+	global $n,$wms_id;
+	$myl = split(",",$l);
+	$r = array();
+	foreach($myl as $mysl){
+		if($n->getLayerPermission($wms_id, $mysl, $_SESSION["mb_user_id"]) === true){
+			array_push($r, $mysl);
+		}		
+	}
+	$ret = implode(",",$r);
+	return $ret;
+}
 ?>
\ No newline at end of file