MapProxy 3.1.2__tar.gz → 3.1.4__tar.gz

{MapProxy-3.1.2 → mapproxy-3.1.4}/CHANGES.txt

@@ -1,3 +1,26 @@
+3.1.4 2025-04-10
+~~~~~~~~~~~~~~~~
+
+Fixes:
+
+- Security fix to prevent XSS injections in demo pages
+- Security fix to prevent reading file urls
+
+
+3.1.3 2024-11-26
+~~~~~~~~~~~~~~~~
+
+Maintenance:
+
+  - Several dependencies for the tests and GitHub actions have been updated
+  - Spelling and grammar mistakes in the documentation corrected
+
+Fixes:
+
+  - The chmod to update file permissions is now only called if the file was freshly created
+  - A bug with clipping polygons that become multi polygons due to the clipping is now fixed
+
+
 3.1.2 2024-11-20
 ~~~~~~~~~~~~~~~~
 

{MapProxy-3.1.2 → mapproxy-3.1.4}/MapProxy.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: MapProxy
-Version: 3.1.2
+Version: 3.1.4
 Summary: An accelerating proxy for tile and web map services
 Home-page: https://mapproxy.org
 Author: Oliver Tonnhofer
@@ -8,7 +8,6 @@ Author-email: olt@omniscale.de
 Maintainer: terrestris GmbH & Co. KG
 Maintainer-email: info@terrestris.de
 License: Apache Software License 2.0
-Platform: UNKNOWN
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Operating System :: OS Independent
@@ -24,6 +23,25 @@ Description-Content-Type: text/x-rst
 License-File: LICENSE.txt
 License-File: COPYING.txt
 License-File: AUTHORS.txt
+Requires-Dist: PyYAML>=3.0
+Requires-Dist: future
+Requires-Dist: pyproj>=2
+Requires-Dist: jsonschema>=4
+Requires-Dist: importlib_resources; python_version <= "3.8"
+Requires-Dist: werkzeug<4
+Requires-Dist: Pillow!=2.4.0,!=8.3.0,!=8.3.1
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: license-file
+Dynamic: maintainer
+Dynamic: maintainer-email
+Dynamic: requires-dist
+Dynamic: summary
 
 MapProxy is an open source proxy for geospatial data. It caches, accelerates and transforms data from existing map services and serves any desktop or web GIS client.
 
@@ -37,6 +55,29 @@ The documentation is available at: http://mapproxy.github.io/mapproxy/latest/
 
 Changes
 -------
+3.1.4 2025-04-10
+~~~~~~~~~~~~~~~~
+
+Fixes:
+
+- Security fix to prevent XSS injections in demo pages
+- Security fix to prevent reading file urls
+
+
+3.1.3 2024-11-26
+~~~~~~~~~~~~~~~~
+
+Maintenance:
+
+  - Several dependencies for the tests and GitHub actions have been updated
+  - Spelling and grammar mistakes in the documentation corrected
+
+Fixes:
+
+  - The chmod to update file permissions is now only called if the file was freshly created
+  - A bug with clipping polygons that become multi polygons due to the clipping is now fixed
+
+
 3.1.2 2024-11-20
 ~~~~~~~~~~~~~~~~
 
@@ -113,40 +154,7 @@ Fixes:
   - Fix gh-pages workflow
 
 
-2.2.0 2024-07-24
-~~~~~~~~~~~~~~~~
-
-Improvements:
-
-  - Add timeout to SQLite connect for geopackages. This helps against locking exceptions
-  - Improvement of documentation, typos, wrong cli commands, old python2 stuff
-  - The WMTS capabilites will now advertise the WMS GetLegendGraphic as a LegendURL if both services are active
-  - It is possible now to configure LegendURLs that should be shown in the WMTS capabilities
-  - A new method for plugins to intercept and modify requests made to MapProxy was added.
-
-Maintenance:
-
-  - Removal of debian package information
-  - Fix docs workflow
-
-Fixes:
-
-  - Remove import of the packaging library that does not appear in the `install_requires`
-  - Only install and use `importlib_resources` in python 3.8
-
-
-2.1.1 2024-07-16
-~~~~~~~~~~~~~~~~
-Fixes:
-
-  - Fix version of jsonschema in setup.py
-  - Fix alpine docker build
-  - Fix doc generation workflow
-
-
 
 Older changes
 -------------
 See https://raw.github.com/mapproxy/mapproxy/master/CHANGES.txt
-
-

{MapProxy-3.1.2 → mapproxy-3.1.4}/MapProxy.egg-info/SOURCES.txt

@@ -485,6 +485,7 @@ mapproxy/util/__init__.py
 mapproxy/util/async_.py
 mapproxy/util/collections.py
 mapproxy/util/coverage.py
+mapproxy/util/escape.py
 mapproxy/util/fs.py
 mapproxy/util/geom.py
 mapproxy/util/lib.py

{MapProxy-3.1.2 → mapproxy-3.1.4}/MapProxy.egg-info/entry_points.txt

@@ -1,4 +1,3 @@
 [console_scripts]
 mapproxy-seed = mapproxy.seed.script:main
 mapproxy-util = mapproxy.script.util:main
-

{MapProxy-3.1.2 → mapproxy-3.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: MapProxy
-Version: 3.1.2
+Version: 3.1.4
 Summary: An accelerating proxy for tile and web map services
 Home-page: https://mapproxy.org
 Author: Oliver Tonnhofer
@@ -8,7 +8,6 @@ Author-email: olt@omniscale.de
 Maintainer: terrestris GmbH & Co. KG
 Maintainer-email: info@terrestris.de
 License: Apache Software License 2.0
-Platform: UNKNOWN
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Operating System :: OS Independent
@@ -24,6 +23,25 @@ Description-Content-Type: text/x-rst
 License-File: LICENSE.txt
 License-File: COPYING.txt
 License-File: AUTHORS.txt
+Requires-Dist: PyYAML>=3.0
+Requires-Dist: future
+Requires-Dist: pyproj>=2
+Requires-Dist: jsonschema>=4
+Requires-Dist: importlib_resources; python_version <= "3.8"
+Requires-Dist: werkzeug<4
+Requires-Dist: Pillow!=2.4.0,!=8.3.0,!=8.3.1
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: license-file
+Dynamic: maintainer
+Dynamic: maintainer-email
+Dynamic: requires-dist
+Dynamic: summary
 
 MapProxy is an open source proxy for geospatial data. It caches, accelerates and transforms data from existing map services and serves any desktop or web GIS client.
 
@@ -37,6 +55,29 @@ The documentation is available at: http://mapproxy.github.io/mapproxy/latest/
 
 Changes
 -------
+3.1.4 2025-04-10
+~~~~~~~~~~~~~~~~
+
+Fixes:
+
+- Security fix to prevent XSS injections in demo pages
+- Security fix to prevent reading file urls
+
+
+3.1.3 2024-11-26
+~~~~~~~~~~~~~~~~
+
+Maintenance:
+
+  - Several dependencies for the tests and GitHub actions have been updated
+  - Spelling and grammar mistakes in the documentation corrected
+
+Fixes:
+
+  - The chmod to update file permissions is now only called if the file was freshly created
+  - A bug with clipping polygons that become multi polygons due to the clipping is now fixed
+
+
 3.1.2 2024-11-20
 ~~~~~~~~~~~~~~~~
 
@@ -113,40 +154,7 @@ Fixes:
   - Fix gh-pages workflow
 
 
-2.2.0 2024-07-24
-~~~~~~~~~~~~~~~~
-
-Improvements:
-
-  - Add timeout to SQLite connect for geopackages. This helps against locking exceptions
-  - Improvement of documentation, typos, wrong cli commands, old python2 stuff
-  - The WMTS capabilites will now advertise the WMS GetLegendGraphic as a LegendURL if both services are active
-  - It is possible now to configure LegendURLs that should be shown in the WMTS capabilities
-  - A new method for plugins to intercept and modify requests made to MapProxy was added.
-
-Maintenance:
-
-  - Removal of debian package information
-  - Fix docs workflow
-
-Fixes:
-
-  - Remove import of the packaging library that does not appear in the `install_requires`
-  - Only install and use `importlib_resources` in python 3.8
-
-
-2.1.1 2024-07-16
-~~~~~~~~~~~~~~~~
-Fixes:
-
-  - Fix version of jsonschema in setup.py
-  - Fix alpine docker build
-  - Fix doc generation workflow
-
-
 
 Older changes
 -------------
 See https://raw.github.com/mapproxy/mapproxy/master/CHANGES.txt
-
-

{MapProxy-3.1.2 → mapproxy-3.1.4}/doc/configuration.rst

@@ -238,7 +238,7 @@ The name of the layer. You can omit the name for group layers (e.g. layers with
 
 ``title``
 """""""""
-Readable name of the layer, e.g WMS layer title.
+Readable name of the layer, e.g. WMS layer title.
 
 
 .. _layers:
@@ -297,14 +297,14 @@ A list of caches for this layer. This list overrides ``sources`` for WMTS and TM
 
 Limit the layer to the given min and max resolution or scale. MapProxy will return a blank image for requests outside of these boundaries (``min_res`` is inclusive, ``max_res`` exclusive). You can use either the resolution or the scale values, missing values will be interpreted as `unlimited`. Resolutions should be in meters per pixel.
 
-The values will also apear in the capabilities documents (i.e. WMS ScaleHint and Min/MaxScaleDenominator).
+The values will also appear in the capabilities documents (i.e. WMS ScaleHint and Min/MaxScaleDenominator).
 
 Please read :ref:`scale vs. resolution <scale_resolution>` for some notes on `scale`.
 
 ``legendurl``
 """""""""""""
 
-Configure a URL to an image that should be returned as the legend for this layer. Local URLs (``file://``) are also supported. MapProxy ignores the legends from the sources of this layer if you configure a ``legendurl`` here. If WMS and WMTS are enabled the address to the WMS `GetLegendGraphic` endpoint will be included in the WMTS capabilities as the legend url.
+Configure a URL to an image that should be returned as the legend for this layer. Local URLs (``file://``) are also supported. MapProxy ignores the legends from the sources of this layer if you configure a ``legendurl`` here. If WMS and WMTS are enabled the address to the WMS `GetLegendGraphic` endpoint will be included in the WMTS capabilities as the legend URL.
 
 .. _layer_metadata:
 
@@ -397,7 +397,7 @@ Each dimension is another dictionary with a list of ``values`` and an optional `
 
 It is possible to configure which URLS the WMTS will advertise as LegendURLs through its capabilities. These will be
 inserted as a ``LegendURL`` tag into the capabilities document. These URLs support two template variables ``{base_url}``
-which is the base url of MapProxy and ``{layer_name}`` which is the name of the layer.
+which is the base URL of MapProxy and ``{layer_name}`` which is the name of the layer.
 
 .. code-block:: yaml
 
@@ -541,7 +541,7 @@ In practice this means that all the linked images will have the first such tile'
 """"""""""""""""""""""""""
 If set to ``true``, MapProxy will only issue a single request to the source. This option can reduce the request latency for uncached areas (on demand caching).
 
-By default MapProxy requests all uncached meta-tiles that intersect the requested bbox. With a typical configuration it is not uncommon that a requests will trigger four requests each larger than 2000x2000 pixel. With the ``minimize_meta_requests`` option enabled, each request will trigger only one request to the source. That request will be aligned to the next tile boundaries and the tiles will be cached.
+By default MapProxy requests all uncached meta-tiles that intersect the requested bbox. With a typical configuration it is not uncommon that a request will trigger four requests each larger than 2000x2000 pixel. With the ``minimize_meta_requests`` option enabled, each request will trigger only one request to the source. That request will be aligned to the next tile boundaries and the tiles will be cached.
 
 .. index:: watermark
 
@@ -616,9 +616,9 @@ MapProxy is able to create missing tiles by rescaling tiles from zoom levels bel
 
 MapProxy will scale up tiles from one or more zoom levels above (with lower resolutions) if you set ``upscale_tiles`` to 1 or higher. The value configures by how many zoom levels MapProxy can search for a proper tile. Higher values allow more blurry results.
 
-You can use ``upscale_tiles`` if you want to provide tiles or WMS responses in a higher resolution then your available cache. This also works with partially seeded caches, eg. where you have an aerial image cache of 20cm, with some areas also in 10cm resolution. ``upscale_tiles`` allows you to provide responses for 10cm requests in all areas, always returning the best available data.
+You can use ``upscale_tiles`` if you want to provide tiles or WMS responses in a higher resolution then your available cache. This also works with partially seeded caches, e.g. where you have an aerial image cache of 20cm, with some areas also in 10cm resolution. ``upscale_tiles`` allows you to provide responses for 10cm requests in all areas, always returning the best available data.
 
-MapProxy will scale down tiles from one or more zoom levels below (with higher resolutions) if you set ``downscale_tiles`` to 1 or higher. The value configures by how many zoom levels MapProxy can search for a proper tile. Note that the number of tiles growth exponentialy. Typically, a single tile can be downscaled from four tiles of the next zoom level. Downscaling from two levels below requires 16 tiles, three levels below requires 64, etc.. A larger WMS request can quickly accumulate thousands of tiles required for downscaling. It is therefore `not` recommended to use ``downscale_tiles`` values larger then one.
+MapProxy will scale down tiles from one or more zoom levels below (with higher resolutions) if you set ``downscale_tiles`` to 1 or higher. The value configures by how many zoom levels MapProxy can search for a proper tile. Note that the number of tiles growth exponentially. Typically, a single tile can be downscaled from four tiles of the next zoom level. Downscaling from two levels below requires 16 tiles, three levels below requires 64, etc.. A larger WMS request can quickly accumulate thousands of tiles required for downscaling. It is therefore `not` recommended to use ``downscale_tiles`` values larger than one.
 
 You can use ``downscale_tiles`` to fill a cache for a source that only provides data for higher resolutions.
 
@@ -677,7 +677,7 @@ Example:
 """"""""""""""""""""
 
 If set to ``true``, MapProxy will not store any tiles for this cache. MapProxy will re-request all required tiles for each incoming request,
-even if the there are matching tiles in the cache. See :ref:`seed_only <wms_seed_only>` if you need an *offline* mode.
+even if there are matching tiles in the cache. See :ref:`seed_only <wms_seed_only>` if you need an *offline* mode.
 
 .. note:: Be careful when using a cache with disabled storage in tile services when the cache uses WMS sources with metatiling.
 
@@ -841,7 +841,7 @@ The total number of cached resolution levels. Defaults to 20, except for grids w
 
 ``min_res`` and ``max_res``
 """""""""""""""""""""""""""
-The the resolutions of the first and the last level.
+The resolutions of the first and the last level.
 
 ``stretch_factor``
 """"""""""""""""""
@@ -849,7 +849,7 @@ MapProxy chooses the `optimal` cached level for requests that do not exactly
 match any cached resolution. MapProxy will stretch or shrink images to the
 requested resolution. The `stretch_factor` defines the maximum factor
 MapProxy is allowed to stretch images. Stretched images result in better
-performance but will look blurry when the value is to large (> 1.2).
+performance but will look blurry when the value is too large (> 1.2).
 
 Example: Your MapProxy caches 10m and 5m resolutions. Requests with 9m
 resolution will be generated from the 10m level, requests for 8m from the 5m
@@ -910,7 +910,7 @@ Example ``grids`` configuration
 sources
 -------
 
-A sources defines where MapProxy can request new data. Each source has a ``type`` and all other options are dependent to this type.
+A source defines where MapProxy can request new data. Each source has a ``type`` and all other options are dependent to this type.
 
 See :doc:`sources` for the documentation of all available sources.
 
@@ -1027,7 +1027,7 @@ The following options define how tiles are created and stored. Most options can
 .. _lock_dir:
 
 ``lock_dir``
-  MapProxy uses locking to limit multiple request to the same service. See ``concurrent_requests``.
+  MapProxy uses locking to limit multiple requests to the same service. See ``concurrent_requests``.
   This option defines where the temporary lock files will be stored. The path
   can either be absolute (e.g. ``/tmp/lock/mapproxy``) or relative to the
   mapproxy.yaml file. Defaults to ``./cache_data/tile_locks``.
@@ -1103,7 +1103,7 @@ The following options define how tiles are created and stored. Most options can
 
 ``axis_order_ne`` and ``axis_order_en``
   The axis ordering defines in which order coordinates are given, i.e. lon/lat or lat/lon.
-  The ordering is dependent to the SRS. Most clients and servers did not respected the
+  The ordering is dependent to the SRS. Most clients and servers did not respect the
   ordering and everyone used lon/lat ordering. With the WMS 1.3.0 specification the OGC
   emphasized that the axis ordering of the SRS should be used.
 
@@ -1212,7 +1212,7 @@ Sets the ``Access-control-allow-origin`` header to HTTP responses for `Cross-ori
 .. versionadded:: 1.14.0
 
 Enables MapProxy cookie management for HTTP sources. When enabled MapProxy will accept and store server cookies. Accepted cookies will be passed
-back to the source on subsequent requests. Usefull for sources which require to maintain an HTTP session to work efficiently, maybe in combination
+back to the source on subsequent requests. Useful for sources which require to maintain an HTTP session to work efficiently, maybe in combination
 with basic authentication. Depending on your deployment MapProxy will still start multiple sessions (e.g. one per MapProxy process).
 Cookie handling is based on Python `CookieJar <https://docs.python.org/3/library/http.cookiejar.html>`_. Disabled by default.
 
@@ -1386,7 +1386,7 @@ Notes
 Scale vs. resolution
 """"""""""""""""""""
 
-Scale is the ratio of a distance on a map and the corresponding distance on the ground. This implies that the map distance and the ground distance are measured in the same unit. For MapProxy a `map` is just a collection of pixels and the pixels do not have any size/dimension. They do correspond to a ground size but the size on the `map` is depended of the physical output format. MapProxy can thus only work with resolutions (pixel per ground unit) and not scales.
+Scale is the ratio of a distance on a map and the corresponding distance on the ground. This implies that the map distance and the ground distance are measured in the same unit. For MapProxy a `map` is just a collection of pixels and the pixels do not have any size/dimension. They do correspond to a ground size but the size on the `map` is depended on the physical output format. MapProxy can thus only work with resolutions (pixel per ground unit) and not scales.
 
 This applies to all servers and the OGC WMS standard as well. Some neglect this fact and assume a fixed pixel dimension (like 72dpi), the OCG WMS 1.3.0 standard uses a pixel size of 0.28 mm/px (around 91dpi). But you need to understand that a `scale` will differ if you print a map (200, 300 or more dpi) or if you show it on a computer display (typical 90-120 dpi, but there are mobile devices with more than 300 dpi).
 

{MapProxy-3.1.2 → mapproxy-3.1.4}/doc/deployment.rst

@@ -49,6 +49,8 @@ Behind an HTTP server or proxy
 
 Both approaches require a configuration that maps your MapProxy configuration with the MapProxy application. You can write a small script file for that.
 
+.. note:: In production mode it is recommended to disable the demo service.
+
 .. _server_script:
 
 Server script

{MapProxy-3.1.2 → mapproxy-3.1.4}/mapproxy/cache/compact.py

@@ -347,8 +347,9 @@ class BundleIndexV1(object):
     @contextlib.contextmanager
     def readwrite(self):
         self._init_index()
+        set_permissions = self.file_permissions and not os.path.exists(self.filename)
         with open(self.filename, 'r+b') as fh:
-            if self.file_permissions:
+            if set_permissions:
                 permission = int(self.file_permissions, base=8)
                 log.info("setting file permissions on compact cache file: " + self.file_permissions)
                 os.chmod(self.filename, permission)

{MapProxy-3.1.2 → mapproxy-3.1.4}/mapproxy/cache/legend.py

@@ -65,9 +65,10 @@ class LegendCache(object):
 
         data = legend.source.as_buffer(ImageOptions(format='image/' + self.file_ext), seekable=True)
         data.seek(0)
+        set_permissions = self.file_permissions and not os.path.exists(legend.location)
         log.debug('writing to %s' % (legend.location))
         write_atomic(legend.location, data.read())
-        if self.file_permissions:
+        if set_permissions:
             permission = int(self.file_permissions, base=8)
             log.info("setting file permissions on compact cache file: " + self.file_permissions)
             os.chmod(legend.location, permission)

{MapProxy-3.1.2 → mapproxy-3.1.4}/mapproxy/config/loader.py

@@ -2446,6 +2446,10 @@ def load_configuration(mapproxy_conf, seed=False, ignore_warnings=True, renderd=
     for error in errors:
         log.warning(error)
 
+    services = conf_dict.get('services')
+    if services is not None and 'demo' in services:
+        log.warning('Application has demo page enabled. It is recommended to disable this in production.')
+
     return ProxyConfiguration(conf_dict, conf_base_dir=conf_base_dir, seed=seed,
                               renderd=renderd)
 

{MapProxy-3.1.2 → mapproxy-3.1.4}/mapproxy/image/mask.py

@@ -71,7 +71,7 @@ def image_mask_from_geom(size, bbox, polygons):
 
         if buffered.geom_type == 'MultiPolygon':
             # negative buffer can turn polygon into multipolygon
-            for p in buffered:
+            for p in buffered.geoms:
                 draw_polygon(p)
         else:
             draw_polygon(buffered)

{MapProxy-3.1.2 → mapproxy-3.1.4}/mapproxy/multiapp.py

@@ -20,6 +20,7 @@ from mapproxy.request import Request
 from mapproxy.response import Response
 from mapproxy.util.collections import LRU
 from mapproxy.wsgiapp import make_wsgi_app as make_mapproxy_wsgi_app
+from mapproxy.util.escape import escape_html
 
 from threading import Lock
 
@@ -95,7 +96,7 @@ class MultiMapProxy(object):
         import mapproxy.version
         html = "<html><body><h1>Welcome to MapProxy %s</h1>" % mapproxy.version.version
 
-        url = req.script_url
+        url = escape_html(req.script_url)
         if self.list_apps:
             html += "<h2>available instances:</h2><ul>"
             html += '\n'.join('<li><a href="%(url)s/%(name)s/">%(name)s</a></li>' % {'url': url, 'name': app}