Fix security issues - thanks @mheranco (#166)

* Fix XSS

* Check if requested tile resides inside the current directory

* Add input validation for "renderTile"

* Use floatval instead of "int" for casting

.travis.yml

@@ -0,0 +1,24 @@
+language: php
+php:
+  - 5.4
+  - 5.5
+  - 5.6
+  - 7.0
+  - 7.1
+  - hhvm
+script:
+  - php tileserver.php
+after_success:
+  - wget https://github.com/klokantech/tileserver-php/releases/download/v0.1/grandcanyon.mbtiles
+  - git config --global user.email "travis@localhost.localdomain"
+  - git config --global user.name "Travis CI"
+  - git add --all
+  - git commit -am "Travis change"
+deploy:
+  provider: openshift
+  user: osm2vectortiles@klokantech.com
+  password:
+    secure: hiWKBaqh/CMdnQ2qxsRSKYAnk4tP/q2J50TaO+2sH09x+0Q85ygfICCDrEx457xqmGW0e4zZPsL83mMPvGt5KJO6g9DIncj6BFhpZA0ysnRJ3X1fczTiVN5hQfqNpa+/YIrQ0whu1Ur/IfdYTtvArYhuAPeigCloumGk9gNgSIQ=
+  domain: tileserver
+  app: php
+  skip_cleanup: true

README.md

@@ -1,36 +1,26 @@
-TileServer PHP - OGC Web Map Tiling Server (WMTS)
+TileServer PHP: MapTiler and MBTiles maps via WMTS
-=================================================
+==================================================
 
-This server distributes maps to desktop, web, and mobile applications from
+[![Build Status](https://travis-ci.org/klokantech/tileserver-php.svg)](https://travis-ci.org/klokantech/tileserver-php)
-a standard Apache+PHP web hosting.
+[![Docker Hub](https://img.shields.io/badge/docker-hub-blue.svg)](https://hub.docker.com/r/klokantech/tileserver-php/)
 
-Try a live demo at: http://tileserver.maptiler.com/
+This server distributes maps to desktop, web, and mobile applications from a standard Apache+PHP web hosting.
 
-It is a free and open-source project implementing OGC WMTS standard for
+It is a free and open-source project implementing the OGC WMTS standard for pre-rendered map tiles made with any [map tiling software](https://www.maptiler.com/desktop/) like MapTiler Desktop, GDAL2Tiles, or any other MBTiles file.
-pre-rendered map tiles made with [MapTiler](http://www.maptiler.com/), GDAL2Tiles,
-or available as MBTiles files.
 
-It is the easiest and cheapest way how to serve zoomable maps in a
+It is the easiest and cheapest way how to serve zoomable maps in a standardized way - practically from any ordinary web hosting.
-standardized way - practically from any ordinary web hosting.
 
-It is easy to install - just copy the project files to a PHP-enabled
+It is easy to install - copy the project files to a PHP-enabled directory along with your map data.
-directory along with your map data.
 
-It comes with an online interface showing the list of the maps and step-by-step guides for online mapping libraries (Google Maps API, Leaflet, OpenLayers, OL3, MapBox JS, ArcGIS JS) and various desktop GIS software:
+It comes with an online interface showing the list of the maps and step-by-step guides for online mapping libraries (Google Maps API, Leaflet, OpenLayers, OL3, MapLibre GL JS, ArcGIS JS) and various desktop GIS software:
 
 ![tileserver-screenshot](https://f.cloud.github.com/assets/59284/1041807/a040160c-0fdb-11e3-8941-ab367b2a648d.png)
 
-This project is developed in PHP, not because it is the best language for
+This project is developed in PHP, not because it is the best language for the development of web applications, but because it maximally simplifies the deployment on a large number of web hostings, including various free web hostings providers.
-development of web applications, but because it maximally simplify the
-deployment on large number of web hosting providers including various free
-web hostings.
 
-Tiles are served directly by Apache with mod_rewrite rules as static files
+Tiles are served directly by Apache with mod_rewrite rules as static files and therefore are very fast and with correct HTTP caching headers. Only XML metadata is delivered via PHP. MBTiles are served via PHP and are therefore slower unless they are unpacked with mbutil.
-and therefore are very fast and with correct HTTP caching headers.
-Only XML metadata are delivered via PHP.
-MBTiles are served via PHP, and are therfore slower, unless they are unpacked with mbutil.
 
-[MapTiler](http://www.maptiler.com/) can render GeoTIFF, ECW, MrSID, GeoPDF into compatible map tiles. JPEG, PNG, GIF and TIFF with scanned maps or images without geolocation can be turned into standard map layers with the visual georeferencing functionality (http://youtu.be/eJxdCe9CNYg).
+[MapTiler](http://www.maptiler.com/) can render GeoTIFF, ECW, MrSID, GeoPDF into compatible map tiles. JPEG, PNG, GIF, and TIFF with scanned maps or images without geolocation can be turned into standard map layers with the visual georeferencing functionality (http://youtu.be/eJxdCe9CNYg).
 
 [![MapTiler - mapping tiles](https://cloud.githubusercontent.com/assets/59284/3037911/583d7810-e0c6-11e3-877c-6a7747b80dd3.jpg)](http://www.maptiler.com/)
 
@@ -38,44 +28,36 @@ Requirements:
 -------------
 
 - Apache webserver (with mod_rewrite / .htaccess supported)
-- PHP 5.2+
+- PHP 5.6+ with SQLite module (php5-sqlite)
 
-(or anther webserver implementing mod_rewrite rules and PHP)
+(or another webserver implementing mod_rewrite rules and PHP)
 
 Installation:
 -------------
 
 Download the project files as a [zip archive](https://github.com/klokantech/tileserver-php/archive/master.zip) or source code from GitHub and unpack it into a web-hosting of your choice.
 
-If you access the web address relevant to the installation directory, 
+If you access the web address relevant to the installation directory, the TileServer.php Server should display you a welcome message and further instructions.
-the TileServer.php Server should display you a welcome message and further
-instructions.
 
-Then you can upload to the web hosting your mapping data - a directory with
+Then you can upload to the web hosting your mapping data - a directory with tiles rendered with [MapTiler](http://www.maptiler.com/).
-tiles rendered with [MapTiler](http://www.maptiler.com/).
 
-Tiles produced by open-source GDAL2Tiles or MapTiler and tiles in .mbtiles
+Tiles produced by open-source GDAL2Tiles or MapTiler Desktop and tiles in .mbtiles format can be easily converted to the required structure (XYZ with top-left origin and metadata.json file). The open-source utility [mbutil](https://github.com/mapbox/mbutil) produces exactly the required format.
-files can be easily converted to required structure (XYZ with top-left origin
-and metadata.json file). The open-source utility [mbutil](https://github.com/mapbox/mbutil) produces
-exactly the required format.
 
-Direct reading of .mbtiles files is supported, but with decreased performance
+Direct reading of .mbtiles files is supported but with decreased performance compared to the static files in a directory. The advantage is easier data management, especially upload over FTP or similar protocols.
-compared to the static files in a directory. The advantage is easier data management,
-especially upload over FTP or similar protocols.
 
 Supported protocols:
 --------------------
 
 - OpenGIS WMTS 1.0.0
-  
+
   The Open Geospatial Consortium (OGC) Web Map Tile Service (WMTS)
   Both KVP and RESTful version 1.0.0:
   http://www.opengeospatial.org/standards/wmts/
-  
+
   Target is maximal compliance to the standard.
-  
+
   Exposed at http://[...]/wmts
-  
+
 - OSGeo TMS 1.0.0
 
   The OSGeo Tile Maps Service, but with inverted y-coordinates:
@@ -87,91 +69,87 @@ Supported protocols:
   flipped y-axis.
 
   Exposed at http://[...]/tms
-  
+
-- TileJSON.js
+- TileJSON
 
   Metadata about the individual maps in a ready to use form for web
   clients following the standard http://mapbox.com/developers/tilejson/
   and with support for JSONP access.
 
-  Exposed at http://[...]/layer.jsonp
+  Exposed at http://[...]/layer.json or .jsonp
-  
+
 - Direct access with XYZ tile requests (to existing tiles in a directory
   or to .mbtiles)
 
   Compatible with Google Maps API / Bing SDK / OpenStreetMap clients.
-  
+
   Exposed at http://[...]/layer/z/x/y.ext
-  
+
-- MapBox UTFgrid request (for existing tiles in .mbtiles with UTFgrid support). Callback is supported 
+- MapBox UTFgrid request (for existing tiles in .mbtiles with UTFgrid support). Callback is supported
 
   Example https://www.mapbox.com/demo/visiblemap/
   Specification https://github.com/mapbox/utfgrid-spec
-  
+
   Exposed at http://[...]/layer/z/x/y.grid.json
-  
 
-To use the OGC WMTS services point your client (desktop or web) to the URL
+- MapBox Vector Tiles (for MBTiles generated by [MapBox Studio Classic](https://www.mapbox.com/mapbox-studio-classic/) or by [OSM2VectorTiles](http://osm2vectortiles.org/) project).
-of 'directory' where you installed tileserver.php project with suffix "wmts".
 
+  Example http://osm2vectortiles.tileserver.com/
+  TileJSON can be used in MapBox Studio Classic, MapBox SDKs/APIs, OpenLayers, etc.
+
+  Exposed at http://[...]/layer/z/x/y.pbf
+
+- Retina / HighDPI routing with 512 tiles
+Use @2x suffix in url for JSONs and tiles. For example http://tileserver.maptiler.com/grandcanyon@2x.json  
+
+To use the OGC WMTS standard, point your client (desktop or web) to the URL of 'directory' where you installed tileserver.php project with suffix "wmts".
 For example: http://www.example.com/directory/wmts
- 
-You can also install the project into a root directory of a virtual server:
-Then the address is: http://www.example.com/wmts
 
-Similarly for another end points.
+If you have installed the project into a root directory of a domain, then the address is: http://www.example.com/wmts
 
 The supported WMTS requests includes:
 
 GetCapabilities RESTful/KVP:
- 
+
    http://[...]/1.0.0/WMTSCapabilities.xml
    http://[...]?service=wmts&request=getcapabilities&version=1.0.0
- 
+
 GetTile RESTful/KVP:
- 
+
    http://[...]/layer/[ANYTHING-OPTIONAL][z]/[x]/[y].[ext]
    http://[...]?service=wmts&request=getTile&layer=[layer]&tilematrix=[z]&tilerow=[y]&tilecol=[y]&format=[ext]
-   
+
-Another example requests are mentioned in the .htaccess.
+Other example requests are mentioned in the .htaccess.
+
+TileServer-PHP supports all coordinates systems. You have to define it with tilejson with specification on https://github.com/klokantech/tilejson-spec/tree/custom-projection/2.2.0
+Or use MapTiler to produce datasets with this specification.
 
 Performance from the web clients
 --------------------------------
 
 It is highly recommended to map several domain names to the service, such as:
+
 http://a.example.com/, http://b.example.com/, http://c.example.com/.
-This can be done with DNS CNAME records pointing to your hosting.
+
-The reason for this is that traditionally browsers will not send more then two
+This can be done with DNS CNAME records pointing to your hosting. The reason for this is that traditionally browsers will not send more than two simultaneous HTTP requests to the same domain - with multiple domains for the same server, you can better saturate the network and receive the maps faster.
-simultaneous http request to the same domain - with multiple domains for the
-same server you can better saturate the network and receive the maps faster.
 
 Performance
 -----------
 
-In case the data are available in a form of directory with XYZ tiles, then
+In case the data are available in the form of a directory with XYZ tiles, then the Apache webserver is serving these files directly as WMTS RESTful or KVP.
-Apache webserver is serving these files directly as WMTS RESTful or KVP.
 
-This means performance is excellent, maps are delivered very fast and large
+This means performance is excellent, maps are delivered very fast, and a large number of concurrent visitors can be handled even with quite low-end hardware or cheap/free web hosting providers.
-number of concurrent visitors can be handled even with quite a low-end
-hardware or cheap/free web hosting providers.
 
-Mod_rewrite rules are utilized to ensure the HTTP requests defined in the OCG
+Mod_rewrite rules are utilized to ensure the HTTP requests defined in the OCG WMTS standard are served, and Apache preserves standard caching headers & eTag.
-WMTS standard are served, and Apache preserve standard caching headers & eTag.
 
-The performance should be significantly better then performance of any other
+The performance should be significantly better than any other tile caching project (such as TileCache.org or GeoWebCache).
-tile caching project (such as TileCache.org or GeoWebCache).
 
-Performance graph for "apache static" comparing other tile caching projects
+Performance graph for "apache static" comparing other tile caching projects is available online at http://code.google.com/p/mod-geocache/wiki/PreliminaryBenchmark
-is available online at:
-http://code.google.com/p/mod-geocache/wiki/PreliminaryBenchmark
 
 Limits of actual implementation
 -------------------------------
 
-With intention, in this moment the project supports only:
+With intention, at this moment, the project supports only:
-- Mercator tiles (a la OpenStreetMap) and Geodetic tiles (WGS84 unprojected)
-  with known and described tiling scheme.
-- All tiles must be 256x256 pixels.
 - We enforce and require XYZ (top-left origin) tiling schema (even for TMS).
 
 Password protection
@@ -180,10 +158,10 @@ Password protection
 HTTP Simple Authentication can be easily added to the server.
 Edit the .htaccess and add these lines:
 
-AuthUserFile /full/path/to/.htpasswd
+    AuthUserFile /full/path/to/.htpasswd
-AuthType Basic
+    AuthType Basic
-AuthName "Secure WMTS"
+    AuthName "Secure WMTS"
-Require valid-user
+    Require valid-user
 
 Create a file called .htpasswd with user:password format.
 You can use a command-line utility:
@@ -202,22 +180,19 @@ TileServer.php can run without any problems over HTTPS, if required.
 Microsoft Windows web-hosting
 -----------------------------
 
-The TileServer.php should run on Windows-powered webservers with Apache
+The TileServer.php should run on Windows-powered webservers with Apache installation if PHP 5.2+ and mod_rewrite are available.
-installation if PHP 5.2+ and mod_rewrite are available.
 
-With the IIS webserver hosting, you may need PHP and IIRF module
+With the IIS webserver hosting, you may need PHP and IIRF module (http://iirf.codeplex.com/) and alter appropriately the rewrite rules.
-(http://iirf.codeplex.com/) and alter appropriately the rewrite rules.
 
 Credits / Contributors
 ----------------------
 
-Project developed initially by Klokan Technologies GmbH, Switzerland in
+Project developed initially by Klokan Technologies GmbH, Switzerland, in cooperation with National Oceanic and Atmospheric Administration - NOAA, USA.
-cooperation with National Oceanic and Atmospheric Administration - NOAA, USA.
 
-- Petr Pridal - Klokan Technologies GmbH <petr.pridal@klokantech.com>
+- Petr Pridal - Klokan Technologies GmbH <petr.pridal@maptiler.com>
 - Jason Woolard - NOAA <jason.woolard@noaa.gov>
 - Jon Sellars - NOAA <jon.sellars@noaa.gov>
-- Dalibor Janak - Klokan Technologies GmbH <dalibor.janak@klokantech.com>
+- Dalibor Janak - Klokan Technologies GmbH <dalibor.janak@maptiler.com>
 
 Tested WMTS/TMS clients
 -----------------------
@@ -236,21 +211,26 @@ Tested WMTS/TMS clients
   http://www.thecarbonproject.com/gaia.php
 - MapBox.js - the loading of maps via TileJSON, interaction layer supported
   https://www.mapbox.com/mapbox.js
+  
+Alternative
+-----------
+
+If you need [map server with commercial support](https://www.maptiler.com/server/), explore the possibilities provided by the MapTiler Server.
 
 BSD License
 -----------
 
-Copyright (C) 2012 Klokan Technologies GmbH
+Copyright (C) 2020 MapTiler AG (https://www.maptiler.com/)
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met: 
+modification, are permitted provided that the following conditions are met:
 
 1. Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer. 
+   list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright notice,
    this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution. 
+   and/or other materials provided with the distribution.
 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED