diff --git a/tests/src/python/test_qgsserver_accesscontrol.py b/tests/src/python/test_qgsserver_accesscontrol.py index 4d3f943d658..53ffc4c69e5 100644 --- a/tests/src/python/test_qgsserver_accesscontrol.py +++ b/tests/src/python/test_qgsserver_accesscontrol.py @@ -103,7 +103,12 @@ class RestrictedAccessControl(QgsAccessControlFilter): if not self._active: return super(RestrictedAccessControl, self).layerFilterSubsetString(layer) - return "pk = 1" if layer.name() == "Hello_SubsetString" else None + if layer.name() == "Hello_SubsetString": + return "pk = 1" + elif layer.name() == "Hello_Project_SubsetString": + return "pkuid = 6 or pkuid = 7" + else: + return None def layerPermissions(self, layer): """ Return the layer rights """ @@ -861,6 +866,42 @@ class TestQgsServerAccessControl(unittest.TestCase): response, headers = self._get_restricted(query_string) self._img_diff_error(response, headers, "Restricted_WMS_GetMap") + def test_wms_getmap_projectsubsetstring(self): + """ test that project set layer subsetStrings are honored""" + query_string = "&".join(["%s=%s" % i for i in { + "MAP": urllib.quote(self.projectPath), + "SERVICE": "WMS", + "VERSION": "1.1.1", + "REQUEST": "GetMap", + "LAYERS": "Hello_Project_SubsetString", + "STYLES": "", + "FORMAT": "image/png", + "BBOX": "-16817707,-4710778,5696513,14587125", + "HEIGHT": "500", + "WIDTH": "500", + "SRS": "EPSG:3857" + }.items()]) + + response, headers = self._get_fullaccess(query_string) + self._img_diff_error(response, headers, "WMS_GetMap_projectsubstring") + + query_string = "&".join(["%s=%s" % i for i in { + "MAP": urllib.quote(self.projectPath), + "SERVICE": "WMS", + "VERSION": "1.1.1", + "REQUEST": "GetMap", + "LAYERS": "Hello_Project_SubsetString", + "STYLES": "", + "FORMAT": "image/png", + "BBOX": "-16817707,-4710778,5696513,14587125", + "HEIGHT": "500", + "WIDTH": "500", + "SRS": "EPSG:3857" + }.items()]) + + response, headers = self._get_restricted(query_string) + self._img_diff_error(response, headers, "Restricted_WMS_GetMap_projectsubstring") + def test_wms_getfeatureinfo_subsetstring(self): query_string = "&".join(["%s=%s" % i for i in { "SERVICE": "WMS", @@ -930,6 +971,113 @@ class TestQgsServerAccessControl(unittest.TestCase): str(response).find("") != -1, "Unexpected result result in GetFeatureInfo Hello/2\n%s" % response) + def test_wms_getfeatureinfo_projectsubsetstring(self): + """test that layer subsetStrings set in projects are honored. This test checks for a feature which should be filtered + out by the project set layer subsetString + """ + query_string = "&".join(["%s=%s" % i for i in { + "SERVICE": "WMS", + "VERSION": "1.1.1", + "REQUEST": "GetFeatureInfo", + "LAYERS": "Hello_Project_SubsetString", + "QUERY_LAYERS": "Hello_Project_SubsetString", + "STYLES": "", + "FORMAT": "image/png", + "BBOX": "-16817707,-4710778,5696513,14587125", + "HEIGHT": "500", + "WIDTH": "500", + "SRS": "EPSG:3857", + "FEATURE_COUNT": "10", + "INFO_FORMAT": "application/vnd.ogc.gml", + "X": "56", + "Y": "144", + "MAP": urllib.quote(self.projectPath) + }.items()]) + + response, headers = self._get_fullaccess(query_string) + self.assertFalse( + str(response).find("") != -1, + "Project set layer subsetString not honored in WMS GetFeatureInfo/1\n%s" % response) + + response, headers = self._get_restricted(query_string) + self.assertFalse( + str(response).find("") != -1, + "Project set layer subsetString not honored in WMS GetFeatureInfo when access control applied/1\n%s" % response) + + def test_wms_getfeatureinfo_projectsubsetstring2(self): + """test that layer subsetStrings set in projects are honored. This test checks for a feature which should be pass + both project set layer subsetString and access control filters + """ + query_string = "&".join(["%s=%s" % i for i in { + "SERVICE": "WMS", + "VERSION": "1.1.1", + "REQUEST": "GetFeatureInfo", + "LAYERS": "Hello_Project_SubsetString", + "QUERY_LAYERS": "Hello_Project_SubsetString", + "STYLES": "", + "FORMAT": "image/png", + "BBOX": "-1623412,3146330,-1603412,3166330", + "HEIGHT": "500", + "WIDTH": "500", + "SRS": "EPSG:3857", + "FEATURE_COUNT": "10", + "INFO_FORMAT": "application/vnd.ogc.gml", + "X": "146", + "Y": "160", + "MAP": urllib.quote(self.projectPath) + }.items()]) + + response, headers = self._get_fullaccess(query_string) + self.assertTrue( + str(response).find("") != -1, + "No result result in GetFeatureInfo Hello/2\n%s" % response) + self.assertTrue( + str(response).find("7") != -1, + "No good result result in GetFeatureInfo Hello/2\n%s" % response) + + response, headers = self._get_restricted(query_string) + self.assertTrue( + str(response).find("") != -1, + "No result result in GetFeatureInfo Hello/2\n%s" % response) + self.assertTrue( + str(response).find("7") != -1, + "No good result result in GetFeatureInfo Hello/2\n%s" % response) + + def test_wms_getfeatureinfo_projectsubsetstring2(self): + """test that layer subsetStrings set in projects are honored. This test checks for a feature which should be pass + the project set layer subsetString but fail the access control checks + """ + query_string = "&".join(["%s=%s" % i for i in { + "SERVICE": "WMS", + "VERSION": "1.1.1", + "REQUEST": "GetFeatureInfo", + "LAYERS": "Hello_Project_SubsetString", + "QUERY_LAYERS": "Hello_Project_SubsetString", + "STYLES": "", + "FORMAT": "image/png", + "BBOX": "3415650,2018968,3415750,2019968", + "HEIGHT": "500", + "WIDTH": "500", + "SRS": "EPSG:3857", + "FEATURE_COUNT": "10", + "INFO_FORMAT": "application/vnd.ogc.gml", + "X": "146", + "Y": "160", + "MAP": urllib.quote(self.projectPath) + }.items()]) + + response, headers = self._get_fullaccess(query_string) + self.assertTrue( + str(response).find("") != -1, + "No result result in GetFeatureInfo Hello/2\n%s" % response) + self.assertTrue( + str(response).find("8") != -1, + "No good result result in GetFeatureInfo Hello/2\n%s" % response) + + response, headers = self._get_restricted(query_string) + self.assertFalse( + str(response).find("") != -1, + "Unexpected result from GetFeatureInfo Hello/2\n%s" % response) # # WFS # # WFS # # WFS # # @@ -980,6 +1128,88 @@ class TestQgsServerAccessControl(unittest.TestCase): str(response).find("") != -1, "Unexpected result in GetFeature\n%s" % response) + def test_wfs_getfeature_project_subsetstring(self): + """Tests access control with a subset string already applied to a layer in a project + 'Hello_Project_SubsetString' layer has a subsetString of "pkuid in (7,8)" + This test checks for retrieving a feature which should be available in with/without access control + """ + data = """ + + + + pkuid + 7 + """.format(xml_ns=XML_NS) + + # should be one result + response, headers = self._post_fullaccess(data) + self.assertTrue( + str(response).find("") != -1, + "No result in GetFeature\n%s" % response) + self.assertTrue( + str(response).find("7") != -1, + "Feature with pkuid=7 not found in GetFeature\n%s" % response) + + response, headers = self._post_restricted(data) + self.assertTrue( + str(response).find("") != -1, + "No result in GetFeature\n%s" % response) + self.assertTrue( + str(response).find("7") != -1, + "Feature with pkuid=7 not found in GetFeature, has been incorrectly filtered out by access controls\n%s" % response) + + def test_wfs_getfeature_project_subsetstring2(self): + """Tests access control with a subset string already applied to a layer in a project + 'Hello_Project_SubsetString' layer has a subsetString of "pkuid in (7,8)" + This test checks for a feature which should be filtered out by access controls + """ + data = """ + + + + pkuid + 8 + """.format(xml_ns=XML_NS) + + # should be one result + response, headers = self._post_fullaccess(data) + self.assertTrue( + str(response).find("") != -1, + "No result in GetFeature\n%s" % response) + self.assertTrue( + str(response).find("8") != -1, + "Feature with pkuid=8 not found in GetFeature\n%s" % response) + + response, headers = self._post_restricted(data) + self.assertFalse( + str(response).find("") != -1, + "Feature with pkuid=8 was found in GetFeature, but should have been filtered out by access controls\n%s" % response) + + def test_wfs_getfeature_project_subsetstring3(self): + """Tests access control with a subset string already applied to a layer in a project + 'Hello_Project_SubsetString' layer has a subsetString of "pkuid in (7,8)" + This test checks for a features which should be filtered out by project subsetStrings. + Eg pkuid 6 passes the access control checks, but should not be shown because of project layer subsetString + """ + data = """ + + + + pkuid + 6 + """.format(xml_ns=XML_NS) + + # should be no results, since pkuid 1 should be filtered out by project subsetString + response, headers = self._post_fullaccess(data) + self.assertTrue( + str(response).find("") == -1, + "Project based layer subsetString not respected in GetFeature\n%s" % response) + + response, headers = self._post_restricted(data) + self.assertFalse( + str(response).find("") != -1, + "Project based layer subsetString not respected in GetFeature with restricted access\n%s" % response) + def _handle_request(self, restricted, *args): accesscontrol._active = restricted result = self._result(server.handleRequest(*args)) diff --git a/tests/testdata/control_images/qgis_server_accesscontrol/Restricted_WMS_GetMap_projectsubstring/Restricted_WMS_GetMap_projectsubstring.png b/tests/testdata/control_images/qgis_server_accesscontrol/Restricted_WMS_GetMap_projectsubstring/Restricted_WMS_GetMap_projectsubstring.png new file mode 100644 index 00000000000..849c64ca976 Binary files /dev/null and b/tests/testdata/control_images/qgis_server_accesscontrol/Restricted_WMS_GetMap_projectsubstring/Restricted_WMS_GetMap_projectsubstring.png differ diff --git a/tests/testdata/control_images/qgis_server_accesscontrol/WMS_GetMap_projectsubstring/WMS_GetMap_projectsubstring.png b/tests/testdata/control_images/qgis_server_accesscontrol/WMS_GetMap_projectsubstring/WMS_GetMap_projectsubstring.png new file mode 100644 index 00000000000..16052c93f2a Binary files /dev/null and b/tests/testdata/control_images/qgis_server_accesscontrol/WMS_GetMap_projectsubstring/WMS_GetMap_projectsubstring.png differ diff --git a/tests/testdata/qgis_server_accesscontrol/_helloworld.db b/tests/testdata/qgis_server_accesscontrol/_helloworld.db index 94fe982542a..b43a0c10f35 100644 Binary files a/tests/testdata/qgis_server_accesscontrol/_helloworld.db and b/tests/testdata/qgis_server_accesscontrol/_helloworld.db differ diff --git a/tests/testdata/qgis_server_accesscontrol/helloworld.db b/tests/testdata/qgis_server_accesscontrol/helloworld.db index 94fe982542a..b43a0c10f35 100644 Binary files a/tests/testdata/qgis_server_accesscontrol/helloworld.db and b/tests/testdata/qgis_server_accesscontrol/helloworld.db differ diff --git a/tests/testdata/qgis_server_accesscontrol/project.qgs b/tests/testdata/qgis_server_accesscontrol/project.qgs index 6c0696bd8a0..5f334df91ac 100644 --- a/tests/testdata/qgis_server_accesscontrol/project.qgs +++ b/tests/testdata/qgis_server_accesscontrol/project.qgs @@ -1,5 +1,5 @@ - + QGIS Server Hello World @@ -12,6 +12,9 @@ + + + @@ -42,7 +45,9 @@ false + 0 + @@ -52,7 +57,6 @@ - hello20131022151106574 @@ -60,6 +64,7 @@ dem20150730091219559 points20150803121107046 Hello_copy20150804164427541 + Hello_SubsetString_copy20160222085231770 @@ -78,6 +83,11 @@ + + + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -174,19 +122,20 @@ + - + - + @@ -195,72 +144,10 @@ - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + @@ -272,80 +159,18 @@ - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -355,6 +180,7 @@ + @@ -363,6 +189,7 @@ + @@ -371,20 +198,23 @@ + + - Hello_copy20150804164427541 - dbname='./helloworld.db' table="hello" (geom) sql= + Hello_SubsetString_copy20160222085231770 + dbname='./helloworld.db' table="hello" (geom) sql="pkuid" in ( 7, 8 ) + - Hello_SubsetString + Hello_Project_SubsetString +proj=merc +a=6378137 +b=6378137 +lat_ts=0.0 +lon_0=0.0 +x_0=0.0 +y_0=0 +k=1.0 +units=m +nadgrids=@null +wktext +no_defs @@ -400,6 +230,7 @@ spatialite + @@ -415,226 +246,41 @@ - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + @@ -700,10 +346,12 @@ + + @@ -781,6 +429,9 @@ + + + 0 0 @@ -813,17 +464,37 @@ - - - - 0 - - generatedlayout + + . + + . + + 0 + . + + 0 + generatedlayout @@ -834,7 +505,328 @@ + + + + + + + + + + + + + + + + + + + Hello_copy20150804164427541 + dbname='./helloworld.db' table="hello" (geom) sql= + + + + + + + Hello_SubsetString + + + +proj=merc +a=6378137 +b=6378137 +lat_ts=0.0 +lon_0=0.0 +x_0=0.0 +y_0=0 +k=1.0 +units=m +nadgrids=@null +wktext +no_defs + 3857 + 3857 + EPSG:3857 + WGS 84 / Pseudo Mercator + merc + WGS84 + false + + + spatialite + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0 + 0 + 0 + pkuid + + + + + + + + + + + . + + + + + + . + + 0 + . + + 0 + generatedlayout + + + + + + + + + + + + + + + @@ -850,6 +842,7 @@ country20131022151106556 dbname='./helloworld.db' table="country" (geom) sql= + @@ -871,6 +864,7 @@ spatialite + @@ -1368,226 +1362,41 @@ - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + @@ -1766,18 +1575,26 @@ - - - - 0 - - generatedlayout + + . + + . + + 0 + . + + 0 + generatedlayout - + + + + + @@ -1790,6 +1607,7 @@ dem20150730091219559 ./dem.tif + @@ -1836,6 +1654,7 @@ hello20131022151106574 dbname='./helloworld.db' table="hello" (geom) sql= + @@ -1857,6 +1676,7 @@ spatialite COALESCE( "pkuid", '<NULL>' ) + @@ -1872,226 +1692,41 @@ - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + @@ -2270,17 +1905,21 @@ - - - - 0 - - generatedlayout + + . + + . + + 0 + . + + 0 + generatedlayout @@ -2291,7 +1930,11 @@ - + + + + + @@ -2307,6 +1950,7 @@ points20150803121107046 dbname='./helloworld.db' table="points" (geom) sql= + @@ -2328,6 +1972,7 @@ spatialite + @@ -2343,7 +1988,7 @@ - + @@ -2352,148 +1997,25 @@ - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + @@ -2669,17 +2191,26 @@ + - - . - - 0 + . - generatedlayout + . + + 0 + . + + 0 + generatedlayout + + + + + @@ -2701,15 +2232,19 @@ 3857 1 + + meters + m2 + + + false + -20609693.37008669599890709 -11055006.82298868149518967 20961935.60850896313786507 19143772.79360072687268257 - - false - 5000 @@ -2719,10 +2254,11 @@ 255 - + None 90 + 1 1 1 0 @@ -2748,7 +2284,7 @@ dem20150730091219559 - + conditions unknown @@ -2798,7 +2334,12 @@ false + 5000 + + + + 2 true @@ -2825,18 +2366,20 @@ 0 + + WGS84 + + Simple test app. + Hello_SubsetString_copy20160222085231770 Hello_copy20150804164427541 country20131022151106556 hello20131022151106574 points20150803121107046 - Simple test app. - - WGS84 - true false +