added validation for gml:coordinates

SE/se-lib/Core/AclBase.php

@@ -322,7 +322,7 @@ class Core_AclBase {
     $DBG = V::get('DBG_XML', 0, $_GET, 'int');
     if($DBG){echo 'C.'.get_class($this).' L.' . __LINE__ . " TODO: F.".__FUNCTION__." \$fieldType({$fieldType}) \$tags:";print_r($tags);echo "\n";}
 
-    $cs = null; $ts = null; $value = null; $wktType = null;
+    $cs = ','; $ts = ' '; $value = null; $wktType = null;
     if ('gml:LineStringPropertyType' == $fieldType) {
       // <gml:LineString srsName="EPSG:4326">
       //   <gml:coordinates cs="," ts=" ">18.25240580856418049,54.48879768607960017 18.27014261382555915,54.46219247818753217</gml:coordinates>
@@ -370,7 +370,40 @@ class Core_AclBase {
       throw new Exception("Error Processing Request - type '{$fieldType}' not supported");
     }
 
-    $wkt = $value;
+    if($DBG){echo 'C.'.get_class($this).' L.' . __LINE__ . " TODO: F.".__FUNCTION__." \$fieldType({$fieldType}) TODO \$value:";print_r($value);echo "\n";}
+    return self::convertGmlCoordsToWkt($wktType, $value, ['cs'=>$cs, 'ts'=>$ts]);
+  }
+
+  /**
+   * @param $wktType: 'POLYGON', 'POINT', 'LINESTRING'
+   * @param $params: array(decimal="." cs="," ts="whitespace")
+   * decimal - decimal separator (default '.')
+   * cs - coordinate values separator (default ',')
+   * ts - tuple separator (a single space by default)
+   *
+   * @example:
+   * <gml:coordinates cs="," ts=" ">18.25240580856418049,54.48879768607960017 18.27014261382555915,54.46219247818753217</gml:coordinates>
+   * Core_AclBase::convertGmlCoordsToWkt('18.25240580856418049,54.48879768607960017 18.27014261382555915,54.46219247818753217', ['cs'=>',', 'ts'=>' '])
+   */
+  public static function convertGmlCoordsToWkt($wktType, $coords, $params = array()) {
+    $cs = V::get('cs', ',', $params);
+    $decimal = V::get('decimal', '.', $params);
+    $ts = V::get('ts', ' ', $params);
+
+    $gmlNumber = '(\-?\d+\\' . $decimal . '?\d*)';
+    $gmlPoint = '(' . $gmlNumber . $cs . $gmlNumber . ')';
+    $gmlPoints = $gmlPoint . '(' . $ts . $gmlPoint . ')+';
+    switch ($wktType) {
+      case 'POINT': $regex = '/^' . "{$gmlPoint}" . '$/'; break;
+      case 'LINESTRING': $regex = '/^' . "{$gmlPoints}" . '$/'; break;
+      case 'POLYGON': $regex = '/^' . "{$gmlPoints}" . '$/'; break;
+      default: throw new Exception("Unsupported geometry type '{$wktType}'");
+    }
+    if (!preg_match($regex, $coords, $matches)) {
+      throw new Exception("Wrong coordinates format for type '{$wktType}'");
+    }
+
+    $wkt = $coords;
     $wkt = str_replace(array($cs, $ts), array('#cs#', '#ts#'), $wkt);
     $wkt = str_replace(array('#cs#', '#ts#'), array(' ', ','), $wkt);
     if ('POLYGON' == $wktType) $wkt = "({$wkt})";// POINT(1 1), LINESTRING(0 0,1 1,2 2), POLYGON((0 0,10 0,10 10,0 10,0 0))