[Mapserver-users] TEMPLATEPATTERN

[Jan Hartmann]

David Fawcett wrote:
> I understand when and why you use TEMPLATEPATTERN in your map file (to
> allow one to change templates through URL substitutions  e.g.
> map_web_template)
> 
> My question is, what pattern are you attempting to match?  Is it the
> name of the map file, the name or part of the name of the template file?
>  
> 

The second: the name of the template file. You can also restrict the 
name of the map file by a regular expression, but this is done 
differently: by an environmental variable MS_MAPFILE_PATTERN, to be set 
at server startup (in Apache by the SetEnv directive).

Note that TEMPLATEPATTERN (and DATAPATTERN) are mandatory when you want 
to give users access to different templates and data over the web; when 
not set, MapServer will ignore requests for other templates/data. On the 
other hand, when MS_MAPFILE_PATTERN is not set, users can still access 
every map on your system (equivalent to MS_MAPFILE_PATTERN .* ).
If you are concerned about security, set it to an absolute path and 
disallow .. in the string.

Jan