From 7437d903c0a87802c3751fc529d2de7098094c72 Mon Sep 17 00:00:00 2001
From: Matthew Bloch <mbloch@nytimes.com>
Date: Tue, 3 Oct 2023 17:12:47 -0400
Subject: [PATCH] v0.6.44

---
 CHANGELOG.md      |  4 ++++
 REFERENCE.md      |  4 +++-
 bin/mapshaper-gui | 11 +++++++++--
 package-lock.json |  4 ++--
 package.json      |  2 +-
 5 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 13d23a84..0f0a6f26 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,7 @@
+v0.6.44
+* Added -style css= option for adding inline CSS to SVG symbols.
+* Bug fixes
+
 v0.6.43
 * Bug fixes
 
diff --git a/REFERENCE.md b/REFERENCE.md
index 51e8a123..2eb4d9d7 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -1,6 +1,6 @@
 # COMMAND REFERENCE
 
-This documentation applies to version 0.6.39 of mapshaper's command line program. Run `mapshaper -v` to check your version. For an introduction to the command line tool, read [this page](https://github.com/mbloch/mapshaper/wiki/Introduction-to-the-Command-Line-Tool) first.
+This documentation applies to version 0.6.43 of mapshaper's command line program. Run `mapshaper -v` to check your version. For an introduction to the command line tool, read [this page](https://github.com/mbloch/mapshaper/wiki/Introduction-to-the-Command-Line-Tool) first.
 
 ## Command line syntax
 
@@ -1213,6 +1213,8 @@ Add common SVG attributes for SVG export and display in the web UI. Attribute va
 
 `class=`           One or more CSS classes, separated by spaces (e.g. `class="light semi-transparent"`)
 
+`css=`             Inline CSS to use as the `style=` attribute of each SVG symbol.
+
 `fill=`            Fill color (e.g. `#eee` `pink` `rgba(0, 0, 0, 0.2)`)
 
 `fill-pattern=`    Definition string for a pattern. There are four pattern types: hatches, dots, squares and dashes. The syntax for each pattern is:
diff --git a/bin/mapshaper-gui b/bin/mapshaper-gui
index 41333c80..1ba2b180 100755
--- a/bin/mapshaper-gui
+++ b/bin/mapshaper-gui
@@ -61,7 +61,10 @@ function startServer(port) {
   http.createServer(function(request, response) {
     var uri = url.parse(request.url).pathname;
     clearTimeout(timeout);
-    if (uri == '/close') {
+    if (uri.includes('..')) {
+      // block attempts to load files outside webroot
+      serve404(response);
+    } else if (uri == '/close') {
       // end process when page closes, unless page is immediately refreshed
       timeout = setTimeout(function() {
         process.exit(0);
@@ -116,10 +119,14 @@ function serveError(text, code, response) {
   response.end();
 }
 
+function serve404(response) {
+  serveError("404 Not Found\n", 404, response);
+}
+
 function serveFile(filename, response) {
   fs.readFile(filename, function(err, content) {
     if (err) {
-      serveError("404 Not Found\n", 404, response);
+      serve404(response);
     } else {
       serveContent(content, response, getMimeType(filename));
     }
diff --git a/package-lock.json b/package-lock.json
index a1c2466e..61d74f1d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "mapshaper",
-  "version": "0.6.43",
+  "version": "0.6.44",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "mapshaper",
-      "version": "0.6.43",
+      "version": "0.6.44",
       "license": "MPL-2.0",
       "dependencies": {
         "@placemarkio/tokml": "^0.3.3",
diff --git a/package.json b/package.json
index 1fde2460..b3c52e33 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "mapshaper",
-  "version": "0.6.43",
+  "version": "0.6.44",
   "description": "A tool for editing vector datasets for mapping and GIS.",
   "keywords": [
     "shapefile",