So, I think the first step to fix #1393246: Interactive geocoding widget is to provide a good generalized API for geocoder to provide an AJAX menu callback.

One of the requirements will be to have some security so that bad-actors can't use any drupal site with geocoder installed as a geocoding service.

Essentially we will have to have something like this: In order to use the AJAX system, a module first needs to call
geocoder_ajax_authorize()

This will generate a token and place it in the user's session. Furthermore we store this token somewhere (cache entry, geocoder_ajax_tokens table, memcache??) and set it to expire in a reasonable amount of time (an hour or so).

When an ajax request comes in we check to make sure the token is valid before doing the geocoding.

Comments

hnln’s picture

hnln commented

Can't you just use the access callback or arguments for a menu callback ? As normally only people with certain rights (create / edit nodes) will need this. You could add a notice saying that if a site administrator gives that permission to anonymous he runs the risk of providing a public geocoding service.

michaelfavia’s picture

michaelfavia commented

Agreed here. Why not use Services existing authorization system and drupals permissions/sessions to manage permissions liek every other part of drupal?

Ignore me if there is a compelling reason to reinvent Services auth i just dont see it yet.

phayes’s picture

phayes commented

Okay cool. Let's do it using normal permissions. Should we have one permission per handler? Or just one global permission? Or both?

michaelfavia’s picture

michaelfavia commented

"Use Geocoder via Services API" or something would satisify most use cases no?

If people need more they don mind asking ;).

phayes’s picture

phayes commented
Status: Active » Fixed

Done! I've decided to implement both a global permission and one-per handler. I wanted to give more fine-grain control if the admin wanted it, but not require it.

This service can be accessed at /geocoder/service/<handler>
and takes the query-parameter "data". Optinally a "output"
paramater may also be passed. "output" corresponds to
geoPHP output formats.

Examples:

/geocoder/service/google?data=4925 Gair Ave, Terrace, BC
/geocoder/service/wkt?data=POINT(10 10)
/geocoder/service/yahoo?data=94112&output=wkt

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

Anonymous’s picture

(not verified) commented
Issue summary: View changes

Fixing error in function name