Skip to content

[Backport branch-8-6] Document [values] option with warning #1108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jmckenna merged 1 commit into from
Aug 14, 2026
+13 −0
Merged

[Backport branch-8-6] Document [values] option with warning #1108

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions en/mapfile/template.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,15 @@ call. *[mapext]* is substituted by a space delimited set of lower left
and upper right coordinates. This would break the URL. *[mapext_esc]*
is substituted by a proper encoded set.

.. warning::

If the datasource is untrusted, use the escaped versions of template
substitutions to avoid cross-site scripting (XSS) vulnerabilities.

For example, if a field contains ``<script>alert(1)</script>`` and the
unescaped value is included in the generated HTML, the script could be
executed in the user's browser.

Format
======

Expand Down Expand Up @@ -772,6 +781,10 @@ processed as a result of a query.

[item name="area" precision="2" commify="2" format="Area is $value"]

[values]
All attribute values of the feature in a single comma-delimited string.
The values are unescaped. Available only when processing query results.

[attribute name],[attrribute name_esc],[attribute item name_raw]
Attribute name from the data table of a queried layer. Only
attributes for the active query layers are accessible. Case must
Expand Down