Re: [Geoserver-devel] Enhancement to sql views - basic SQL parameter escaping

2013-04-17 Thread Geoff Williams
On 18/04/13 00:09, Andrea Aime wrote: > Thanks, I'll have a look as soon as possible. Given that at work I'm > buried , and this weekend I have to help doing the 2.3.1 release (since no > other developer stepped in)... it's likely going to be delayed to the > weekend after it No worries Andrea, a

Re: [Geoserver-devel] Enhancement to sql views - basic SQL parameter escaping

2013-04-17 Thread Andrea Aime
On Wed, Apr 17, 2013 at 4:04 PM, Geoff Williams wrote: > Hi List, > > > I'd like to propose an enhancement to SQL views to allow the option >> of SQL >> escaping a string that has already passed regular expression >> validation >> before running the SQL. >> > I've had a go at this

Re: [Geoserver-devel] Enhancement to sql views - basic SQL parameter escaping

2013-04-17 Thread Geoff Williams
Hi List, > I'd like to propose an enhancement to SQL views to allow the option > of SQL > escaping a string that has already passed regular expression validation > before running the SQL. I've had a go at this, please see: https://github.com/geotools/geotools/pull/186 https://githu

Re: [Geoserver-devel] Enhancement to sql views - basic SQL parameter escaping

2013-04-15 Thread Geoff Williams
Hi Andrea, I'd like to propose an enhancement to SQL views to allow the option of SQL escaping a string that has already passed regular expression validation before running the SQL. This sounds like a backwards incompatible change, I believe it should be a separate flag?

Re: [Geoserver-devel] Enhancement to sql views - basic SQL parameter escaping

2013-04-14 Thread Andrea Aime
On Fri, Apr 12, 2013 at 9:40 AM, wrote: > Hi List, > > I'm using SQL views quite extensively to run custom SQL in GeoServer, but > I've now reached a point where my developers are raising bug reports to > modify the validation regular expression to allow identifiers that contain > quotes. > > At

Re: [Geoserver-devel] Enhancement to sql views - basic SQL parameter escaping

2013-04-14 Thread Geoff Williams
I think this would just be in the geoserver code. Idea is to apply the escaping to the parameters if they pass regexp validation so it would be right next to that code where ever it is at the moment Jody Garnett wrote: >Is your option just hitting the GeoServer codebase? Or does it have to >be

Re: [Geoserver-devel] Enhancement to sql views - basic SQL parameter escaping

2013-04-14 Thread Jody Garnett
Is your option just hitting the GeoServer codebase? Or does it have to be pushed into the JDBCDataStore classes? -- Jody Garnett On Friday, 12 April 2013 at 5:40 PM, ge...@geoffwilliams.me.uk wrote: > I'd like to propose an enhancement to SQL views to allow the option of SQL > escaping a str