[MapServer-dev] Allow UNC map and context paths in Windows CGI validation

[Jeff McKenna]

Hi Tamas,

I am sorry for not being clear: I was aware that you were closing the 
ticket, but in the ticket you had mentioned that you were going to 
handle this through documentation instead.  I likely misunderstood you here.

Anyway, no worries, I think it is too tricky, with security concerns 
today, to mention this change in code or documentation.

-jeff



On 2026-10-20 9:51 a.m., Tamas Szekeres wrote:
> Hi Jeff,
> 
> I prefer to close this ticket without including the PR since we have the 
> option to override the default setting in the mapserver config file.
> 
> Best regards,
> 
> Tamas
> 
> 
> Jeff McKenna via MapServer-dev <mapserver-dev at lists.osgeo.org 
> <mailto:mapserver-dev at lists.osgeo.org>> ezt írta (időpont: 2026. okt. 
> 20., K, 13:25):
> 
>     Hi Tamas,
> 
>     It sounds like you are going to tackle this through documentation
>     instead.  Please make sure to make the warning stand-out in the doc
>     (using the 'warning' directive) as this change could be a major
>     security
>     vulnerability - or, I can add that warning later.
> 
>     thanks,
> 
>     -jeff
> 
> 
> 
> 
> 
>     On 2026-10-18 3:11 p.m., Tamas Szekeres via MapServer-dev wrote:
>      > Hi Developers,
>      >
>      > We had a discussion <https://lists.osgeo.org/pipermail/mapserver-
>     <https://lists.osgeo.org/pipermail/mapserver->
>      > dev/2022-February/016699.html> a couple of years ago about
>     allowing UNC
>      > paths in mapfiles on Windows. I've created a ticket <https://
>     github.com/ <https://github.com/>
>      > MapServer/MapServer/issues/7668> and a suggested PR <https://
>     github.com/ <https://github.com/>
>      > MapServer/MapServer/pull/7669> to implement the change, but I'm a
>     bit
>      > uncertain whether this requires an RFC and voting or we can treat
>     this
>      > as a bugfix only. Let me know what you think.
>      >
>      > Best regards,
>      >
>      > Tamas
>      >