Filter string in qgis server: Allow strings and attribute names with spaces

src/mapserver/qgswmsserver.cpp

@@ -1862,6 +1862,9 @@ bool QgsWMSServer::testFilterStringSafety( const QString& filter ) const
   }
 
   QStringList tokens = filter.split( " ", QString::SkipEmptyParts );
+  groupStringList( tokens, "'" );
+  groupStringList( tokens, "\"" );
+
   QStringList::const_iterator tokenIt = tokens.constBegin();
   for ( ; tokenIt != tokens.constEnd(); ++tokenIt )
   {
@@ -1926,6 +1929,55 @@ bool QgsWMSServer::testFilterStringSafety( const QString& filter ) const
   return true;
 }
 
+void QgsWMSServer::groupStringList( QStringList& list, const QString& groupString )
+{
+  //group contens within single quotes together
+  bool groupActive = false;
+  int startGroup = -1;
+  int endGroup = -1;
+  QString concatString;
+
+  for ( int i = 0; i < list.size(); ++i )
+  {
+    QString& str = list[i];
+    if ( str.startsWith( groupString ) )
+    {
+      startGroup = i;
+      groupActive = true;
+      concatString.clear();
+    }
+
+    if ( groupActive )
+    {
+      if ( i != startGroup )
+      {
+        concatString.append( " " );
+      }
+      concatString.append( str );
+    }
+
+    if ( str.endsWith( groupString ) )
+    {
+      endGroup = i;
+      groupActive = false;
+
+      if ( startGroup != -1 )
+      {
+        list[startGroup] = concatString;
+        for ( int j = startGroup + 1; j <= endGroup; ++j )
+        {
+          list.removeAt( j );
+          --i;
+        }
+      }
+
+      concatString.clear();
+      startGroup = -1;
+      endGroup = -1;
+    }
+  }
+}
+
 QStringList QgsWMSServer::applyFeatureSelections( const QStringList& layerList ) const
 {
   QStringList layersWithSelections;

src/mapserver/qgswmsserver.h

@@ -160,6 +160,8 @@ class QgsWMSServer
     /**Tests if a filter sql string is allowed (safe)
       @return true in case of success, false if string seems unsafe*/
     bool testFilterStringSafety( const QString& filter ) const;
+    /**Helper function for filter safety test. Groups stringlist to merge entries starting/ending with quotes*/
+    static void groupStringList( QStringList& list, const QString& groupString );
 
     /**Select vector features with ids specified in parameter SELECTED, e.g. ...&SELECTED=layer1:1,2,9;layer2:3,5,10&...
       @return list with layer ids where selections have been created*/