Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Server] Extend the WMS FILTER whitelist with IS, NOT, NULL #31517

Merged
merged 1 commit into from
Sep 6, 2019

Conversation

rldhont
Copy link
Contributor

@rldhont rldhont commented Sep 1, 2019

The QGIS Server Filter parameter accept OGC Filter and an SQL where clause.

In the case of the SQL where clause, to avoid injection and garanty some safety, QGIS Server uses a whitelist of allowed characters and keywords.
The whitelist was AND,OR,IN,=,<,>=,>,>=,!=,',',(,),DMETAPHONE,SOUNDEX.

We need to be able to handle NULL values.

Description

Checklist

  • Commit messages are descriptive and explain the rationale for changes
  • Commits which fix bugs include Fixes #11111 at the bottom of the commit message
  • I have read the QGIS Coding Standards and this PR complies with them
  • New unit tests have been added for core changes
  • I have run the scripts/prepare-commit.sh script before each commit
  • I have evaluated whether it is appropriate for this PR to be backported, backport requests are left as label or comment

@rldhont rldhont added the Server Related to QGIS server label Sep 1, 2019
@rldhont rldhont added this to the 3.10.0 milestone Sep 1, 2019
The QGIS Server Filter parameter accept OGC Filter and an SQL where clause.

In the case of the SQL where clause, to avoid injection and garanty some safety, QGIS Server uses a whitelist of allowed characters and keywords.
The whitelist was AND,OR,IN,=,<,>=,>,>=,!=,',',(,),DMETAPHONE,SOUNDEX.

We need to be able to handle NULL values.
@pblottiere
Copy link
Member

If memory serves me right, I think that this PR fixes an issue raised by @elemoine some weeks ago, but I didn't succeed in retrieving the dedicated ticket...

@elemoine
Copy link
Contributor

elemoine commented Sep 2, 2019

If memory serves me right, I think that this PR fixes an issue raised by @elemoine some weeks ago, but I didn't succeed in retrieving the dedicated ticket...

Indeed.

And the change looks good to me.

@rldhont
Copy link
Contributor Author

rldhont commented Sep 5, 2019

@mhugent, @elpaso any objections to merge?

Would someone like it to backport?

@elpaso
Copy link
Contributor

elpaso commented Sep 5, 2019

+1 for merge and backport

@rldhont rldhont merged commit 1bf89c7 into qgis:master Sep 6, 2019
@backporting
Copy link
Contributor

backporting bot commented Sep 6, 2019

The backport to release-3_4 failed:

Commits ["2c2197867c4901c5353cb262b3b54ac155991f7c"] could not be cherry-picked on top of release-3_4

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub.
git fetch
# Create new working tree.
git worktree add .worktrees/backport release-3_4
# Navigate to the new directory.
cd .worktrees/backport
# Cherry-pick all the commits of this pull request and resolve the likely conflicts.
git cherry-pick 2c2197867c4901c5353cb262b3b54ac155991f7c
# Create a new branch with these backported commits.
git checkout -b backport-31517-to-release-3_4
# Push it to GitHub.
git push --set-upstream origin backport-31517-to-release-3_4
# Go back to the original working tree.
cd ../..
# Delete the working tree.
git worktree remove .worktrees/backport

Then, create a pull request where the base branch is release-3_4 and the compare/head branch is backport-31517-to-release-3_4.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Server Related to QGIS server
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants