[Mapserver-users] 4.0 DATA Keyword / CGI variable

[Vincent Schut]

Shannon,

this was an security enhancement.
from the mapserver wiki MigrationGuide 
(http://mapserver.gis.umn.edu/cgi-bin/wiki.pl?MigrationGuide):

     DATAPATTERN and TEMPLATEPATTERN 

    New MAP level parameters called DATAPATTERN and TEMPLATEPATTERN are 
available. They define regular expressions to be applied to requests to 
change DATA or any template values via URL requests (i.e. 
map_layername_data=...). If a pattern doesn't exist then web users can't 
monkey with support files via URLs. This allows you to isolate one 
application from another if you desire, with the default operation being very 
conservative. 

    For more information on DATAPATTERN syntax (it applies to TEMPLATEPATTERN 
as well), see this post: 
http://mapserver.gis.umn.edu/data2/wilma/mapserver-users/0302/msg00795.html

Cheers,
Vincent.

On Thursday 07 August 2003 14:43, Shannon Scott wrote:
> Hello,
> I have a layer ( below ) that is in an Oracle DB.  We change the DATA
> parameter "on the fly" ( via CGI variable ) to select and highlight the
> polygon we want to display.  This worked very well in 3.6, but we are
> unable to change the DATA parameter since we upgraded to 4.0.  I can still
> change other keyword parameters ( for example COLOR ). Has anyone else
> experienced this?  Workaround?
> Any info, or advice is greatly appreciated.
> Thank You.
> Shannon
>
> Apache CGI
> Linux RedHat 8.0
> MN Mapserver 4.0
>
>
> LAYER
>   NAME selectedpoly
>   TYPE Polygon
>   STATUS default
>   CONNECTIONTYPE oraclespatial
>   CONNECTION "xxx/xxx at locinc9"
>   TRANSPARENCY 50
>
>   DATA "GEOM from (select a.GEOM from tracts1 a where a.id=23019000100)"
>
>  CLASS
>   NAME "selectedpolyclass"
>   COLOR 255 255 191
>   OUTLINECOLOR 8 8 8
>   END  # CLASS
>
>   PROJECTION
>     "proj=latlong"
>   END
> END  # Tracts LAYER

-- 
______________________________________
Vincent Schut
Sarvision B.V.
Wageningen, The Netherlands
www.sarvision.com