[Geoserver-devel] Getting Store source files from a FeatureTypeInfo(Impl)?

I'm trying to extend Daniele's work on DirectDownload to handle non-Coverage
cases. I understand that this isn't going to work for every case (e.g. if it
is a database Store), but the case I'm interested in should be a file.

The web part seems OK, and I'm up to the part where I need to handle building
the download links in the metadata customizer.

So I'm trying to create an equivalent to the linksFromCoverage() method:
https://github.com/geoserver/geoserver/blob/master/src/extension/csw/core/src/main/java/org/geoserver/csw/DownloadLinkHandler.java#L240
that takes a FeatureTypeInfo.

I've tries a couple of things with getting the connection parameters, and with
getting a DataAccess, but I'm not really any closer to finding a way to get the
files that the underlying DataStore is using.

Can anyone suggest how to get the applicable file(s) (e.g. each file in a
shapefile set) without special-casing each data store type (e.g. a case for
ShapefileDataStore, DirectoryDataStore, etc)?

I see the use of ResourceInfo -> FileResourceInfo in the coverage case, but I
don't see how to get something like that from the FeatureTypeInfo.

Brad

On Sat, Nov 7, 2015 at 3:40 AM, Brad Hards <bradh@anonymised.com> wrote:

I'm trying to extend Daniele's work on DirectDownload to handle
non-Coverage
cases. I understand that this isn't going to work for every case (e.g. if
it
is a database Store), but the case I'm interested in should be a file.

The web part seems OK, and I'm up to the part where I need to handle
building
the download links in the metadata customizer.

So I'm trying to create an equivalent to the linksFromCoverage() method:

https://github.com/geoserver/geoserver/blob/master/src/extension/csw/core/src/main/java/org/geoserver/csw/DownloadLinkHandler.java#L240
that takes a FeatureTypeInfo.

I've tries a couple of things with getting the connection parameters, and
with
getting a DataAccess, but I'm not really any closer to finding a way to
get the
files that the underlying DataStore is using.

Can anyone suggest how to get the applicable file(s) (e.g. each file in a
shapefile set) without special-casing each data store type (e.g. a case for
ShapefileDataStore, DirectoryDataStore, etc)?

I see the use of ResourceInfo -> FileResourceInfo in the coverage case,
but I
don't see how to get something like that from the FeatureTypeInfo.

Hi Brad,
the plan for vector data was to get the FeatureSource, call getInfo() and
see if the returned ResourceInfo is a FileResourceInfo.
File based stores may return one, database backed ones won't

Hope this helps

Cheers
Andrea

--

GeoServer Professional Services from the experts! Visit
http://goo.gl/it488V for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

*AVVERTENZE AI SENSI DEL D.Lgs. 196/2003*

Le informazioni contenute in questo messaggio di posta elettronica e/o
nel/i file/s allegato/i sono da considerarsi strettamente riservate. Il
loro utilizzo è consentito esclusivamente al destinatario del messaggio,
per le finalità indicate nel messaggio stesso. Qualora riceviate questo
messaggio senza esserne il destinatario, Vi preghiamo cortesemente di
darcene notizia via e-mail e di procedere alla distruzione del messaggio
stesso, cancellandolo dal Vostro sistema. Conservare il messaggio stesso,
divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo, od
utilizzarlo per finalità diverse, costituisce comportamento contrario ai
principi dettati dal D.Lgs. 196/2003.

The information in this message and/or attachments, is intended solely for
the attention and use of the named addressee(s) and may be confidential or
proprietary in nature or covered by the provisions of privacy act
(Legislative Decree June, 30 2003, no.196 - Italy's New Data Protection
Code).Any use not in accord with its purpose, any disclosure, reproduction,
copying, distribution, or either dissemination, either whole or partial, is
strictly forbidden except previous formal approval of the named
addressee(s). If you are not the intended recipient, please contact
immediately the sender by telephone, fax or e-mail and delete the
information in this message that has been received in error. The sender
does not give any warranty or accept liability as the content, accuracy or
completeness of sent messages and accepts no responsibility for changes
made after they were sent or for other risks which arise as a result of
e-mail transmission, viruses, etc.

-------------------------------------------------------

Oh, one more thing, while for shapefiles and directories of shapefiles using the featuresource is probably
the right way to go, for geopackage I guess we should check the DataAccess ServiceInfo instead, and see if
it’s a FileServiceInfo instead.

So two checks to do I assume, first see if there is anything layer specific in the feature source, and if not,
maybe provide the download link to the entire store… hum… not entirely sure about this one though… what
if the store contains some open and some restricted layer… this poses security questions, not so straighforward
I’m afraid…

Cheers
Andrea

···

On Sat, Nov 7, 2015 at 11:53 AM, Andrea Aime <andrea.aime@anonymised.com268…> wrote:

On Sat, Nov 7, 2015 at 3:40 AM, Brad Hards <bradh@anonymised.com> wrote:

I’m trying to extend Daniele’s work on DirectDownload to handle non-Coverage
cases. I understand that this isn’t going to work for every case (e.g. if it
is a database Store), but the case I’m interested in should be a file.

The web part seems OK, and I’m up to the part where I need to handle building
the download links in the metadata customizer.

So I’m trying to create an equivalent to the linksFromCoverage() method:
https://github.com/geoserver/geoserver/blob/master/src/extension/csw/core/src/main/java/org/geoserver/csw/DownloadLinkHandler.java#L240
that takes a FeatureTypeInfo.

I’ve tries a couple of things with getting the connection parameters, and with
getting a DataAccess, but I’m not really any closer to finding a way to get the
files that the underlying DataStore is using.

Can anyone suggest how to get the applicable file(s) (e.g. each file in a
shapefile set) without special-casing each data store type (e.g. a case for
ShapefileDataStore, DirectoryDataStore, etc)?

I see the use of ResourceInfo → FileResourceInfo in the coverage case, but I
don’t see how to get something like that from the FeatureTypeInfo.

Hi Brad,
the plan for vector data was to get the FeatureSource, call getInfo() and
see if the returned ResourceInfo is a FileResourceInfo.
File based stores may return one, database backed ones won’t

Hope this helps

Cheers
Andrea

==
GeoServer Professional Services from the experts! Visit
http://goo.gl/it488V for more information.

Ing. Andrea Aime

@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

AVVERTENZE AI SENSI DEL D.Lgs. 196/2003

Le informazioni contenute in questo messaggio di posta elettronica e/o nel/i file/s allegato/i sono da considerarsi strettamente riservate. Il loro utilizzo è consentito esclusivamente al destinatario del messaggio, per le finalità indicate nel messaggio stesso. Qualora riceviate questo messaggio senza esserne il destinatario, Vi preghiamo cortesemente di darcene notizia via e-mail e di procedere alla distruzione del messaggio stesso, cancellandolo dal Vostro sistema. Conservare il messaggio stesso, divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo, od utilizzarlo per finalità diverse, costituisce comportamento contrario ai principi dettati dal D.Lgs. 196/2003.

The information in this message and/or attachments, is intended solely for the attention and use of the named addressee(s) and may be confidential or proprietary in nature or covered by the provisions of privacy act (Legislative Decree June, 30 2003, no.196 - Italy’s New Data Protection Code).Any use not in accord with its purpose, any disclosure, reproduction, copying, distribution, or either dissemination, either whole or partial, is strictly forbidden except previous formal approval of the named addressee(s). If you are not the intended recipient, please contact immediately the sender by telephone, fax or e-mail and delete the information in this message that has been received in error. The sender does not give any warranty or accept liability as the content, accuracy or completeness of sent messages and accepts no responsibility for changes made after they were sent or for other risks which arise as a result of e-mail transmission, viruses, etc.


==
GeoServer Professional Services from the experts! Visit
http://goo.gl/it488V for more information.

Ing. Andrea Aime

@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

AVVERTENZE AI SENSI DEL D.Lgs. 196/2003

Le informazioni contenute in questo messaggio di posta elettronica e/o nel/i file/s allegato/i sono da considerarsi strettamente riservate. Il loro utilizzo è consentito esclusivamente al destinatario del messaggio, per le finalità indicate nel messaggio stesso. Qualora riceviate questo messaggio senza esserne il destinatario, Vi preghiamo cortesemente di darcene notizia via e-mail e di procedere alla distruzione del messaggio stesso, cancellandolo dal Vostro sistema. Conservare il messaggio stesso, divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo, od utilizzarlo per finalità diverse, costituisce comportamento contrario ai principi dettati dal D.Lgs. 196/2003.

The information in this message and/or attachments, is intended solely for the attention and use of the named addressee(s) and may be confidential or proprietary in nature or covered by the provisions of privacy act (Legislative Decree June, 30 2003, no.196 - Italy’s New Data Protection Code).Any use not in accord with its purpose, any disclosure, reproduction, copying, distribution, or either dissemination, either whole or partial, is strictly forbidden except previous formal approval of the named addressee(s). If you are not the intended recipient, please contact immediately the sender by telephone, fax or e-mail and delete the information in this message that has been received in error. The sender does not give any warranty or accept liability as the content, accuracy or completeness of sent messages and accepts no responsibility for changes made after they were sent or for other risks which arise as a result of e-mail transmission, viruses, etc.


On Sat, 7 Nov 2015 05:12:54 PM Andrea Aime wrote:

Oh, one more thing, while for shapefiles and directories of shapefiles
using the featuresource is probably
the right way to go, for geopackage I guess we should check the DataAccess
ServiceInfo instead, and see if
it's a FileServiceInfo instead.

OK. I've only just started down this path, and this definitely helps.

So two checks to do I assume, first see if there is anything layer specific
in the feature source, and if not,
maybe provide the download link to the entire store... hum... not entirely
sure about this one though... what
if the store contains some open and some restricted layer... this poses
security questions, not so straighforward
I'm afraid...

We already have this issue with netcdf (for example) coverage DirectDownload,
where you might be exposing only some layers.

Brad

On Sat, Nov 7, 2015 at 10:59 PM, Brad Hards <bradh@anonymised.com> wrote:

> So two checks to do I assume, first see if there is anything layer
specific
> in the feature source, and if not,
> maybe provide the download link to the entire store... hum... not
entirely
> sure about this one though... what
> if the store contains some open and some restricted layer... this poses
> security questions, not so straighforward
> I'm afraid...
We already have this issue with netcdf (for example) coverage
DirectDownload,
where you might be exposing only some layers.

Indeed... we should at least document the potential issue

Cheers
Andrea

--

GeoServer Professional Services from the experts! Visit
http://goo.gl/it488V for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

*AVVERTENZE AI SENSI DEL D.Lgs. 196/2003*

Le informazioni contenute in questo messaggio di posta elettronica e/o
nel/i file/s allegato/i sono da considerarsi strettamente riservate. Il
loro utilizzo è consentito esclusivamente al destinatario del messaggio,
per le finalità indicate nel messaggio stesso. Qualora riceviate questo
messaggio senza esserne il destinatario, Vi preghiamo cortesemente di
darcene notizia via e-mail e di procedere alla distruzione del messaggio
stesso, cancellandolo dal Vostro sistema. Conservare il messaggio stesso,
divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo, od
utilizzarlo per finalità diverse, costituisce comportamento contrario ai
principi dettati dal D.Lgs. 196/2003.

The information in this message and/or attachments, is intended solely for
the attention and use of the named addressee(s) and may be confidential or
proprietary in nature or covered by the provisions of privacy act
(Legislative Decree June, 30 2003, no.196 - Italy's New Data Protection
Code).Any use not in accord with its purpose, any disclosure, reproduction,
copying, distribution, or either dissemination, either whole or partial, is
strictly forbidden except previous formal approval of the named
addressee(s). If you are not the intended recipient, please contact
immediately the sender by telephone, fax or e-mail and delete the
information in this message that has been received in error. The sender
does not give any warranty or accept liability as the content, accuracy or
completeness of sent messages and accepts no responsibility for changes
made after they were sent or for other risks which arise as a result of
e-mail transmission, viruses, etc.

-------------------------------------------------------

On Sun, 8 Nov 2015 10:36:08 AM Andrea Aime wrote:

On Sat, Nov 7, 2015 at 10:59 PM, Brad Hards <bradh@anonymised.com> wrote: what
> We already have this issue with netcdf (for example) coverage
> DirectDownload,
> where you might be exposing only some layers.

Indeed... we should at least document the potential issue

Do you think something like the following is enough?

+.. note:: Enabling DirectDownload for a layer will allow download of the underlying file(s) that
+are used in the data store, even if part of the data store information would otherwise be protected
+by access controls.
+

If so, I'll make it into a pull request.

Brad

Hi,

Could it be better to emphasize the security risk a bit by saying "Do not enable direct download if underlying files ..." and suggest a workaround like to split the file based datastore into public and protected ones before publishing and list store types which are affected?

-Jukka Rahkonen-

________________________________________
Brad Hards wrote:

On Sun, 8 Nov 2015 10:36:08 AM Andrea Aime wrote:

On Sat, Nov 7, 2015 at 10:59 PM, Brad Hards <bradh@anonymised.com> wrote: what
> We already have this issue with netcdf (for example) coverage
> DirectDownload,
> where you might be exposing only some layers.

Indeed... we should at least document the potential issue

Do you think something like the following is enough?

+.. note:: Enabling DirectDownload for a layer will allow download of the underlying file(s) that
+are used in the data store, even if part of the data store information would otherwise be protected
+by access controls.
+

If so, I'll make it into a pull request.

Brad

------------------------------------------------------------------------------
_______________________________________________
Geoserver-devel mailing list
Geoserver-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/geoserver-devel

On Sun, 8 Nov 2015 10:20:37 AM Rahkonen Jukka wrote:

Hi,

Could it be better to emphasize the security risk a bit by saying "Do not
enable direct download if underlying files ..." and suggest a workaround
like to split the file based datastore into public and protected ones
before publishing and list store types which are affected?

Extended words:
.. note:: Enabling DirectDownload for a layer will allow download of the
underlying file(s) that are used in the data store, even if part of the data
store information would otherwise be protected by access controls. Do not
enable DirectDownload if you are trying to limit access to part or all of the
data in the supporting data store. Consider separating mosaic'd and other
composite stores into public and protected sets where this is appropriate, and
selectively enabling the DirectDownload option.

I'm reluctant to suggest store types, because its inherently extensible, and
there are already a lot of ways to compose stores.

Brad