The PHP/Mapscript extension provides full map customization capabilities within the PHP scripting language.
Provides
Requires
License
MIT
Changelog
* Sat Sep 12 2026 Martin Pluskal <mpluskal@suse.com>
- Update to release 8.6.6 (security release):
* WCS 2.0 GetCoverage: reject non-positive RESOLUTION
* CGI query path: fix SMOOTHSIA point-shape worker abort
* WMS: bound exception response copy, fix interpolation
layer heap write and error image sizing
* WMS/WFS filters: cap operation count, handle NaN
coordinates
* FlatGeobuf: reject features failing property decode
* Sun Jul 12 2026 Jan Engelhardt <jengelh@inai.de>
- Update to release 8.6.5
* Properly escape mapserv_onlineresource in OpenLayers viewer
with WMS
* PostGIS: make sure identifier value is numeric when the
declared type is numeric too
* OGC API Features: validate offset before rendering to fix
reflected XSS
* WCS POST: NULL-Dereference Denial of Service When `BoundingBox`
Omits `crs`
* Reflected XSS in WMS OpenLayers output via the
`X-Forwarded-Host` header
* Heap buffer overflow in WMS GetLegendGraphic via repeated LAYER
parameters
* msMySQLJoinNext(): prevent SQL injection
* msPOSTGRESQLJoinNext(): avoid potential SQL injection
* Thu May 28 2026 Jan Engelhardt <jengelh@inai.de>
- Update to releasee 8.6.3
* SLD parser: fix out of bounds access on SLD with only a Rule
with a ElseFilter but without a symbolizer
[CVE-2026-33721, boo#1260869] [CVE-2026-45104, boo#1266663]
* Sat Apr 25 2026 Jan Engelhardt <jengelh@inai.de>
- Update to release 8.6.2
* Fix GetFeatureInfo raster queries with NaN
* Fix segmentation fault in PHP MapScriptNG
* Fri Mar 27 2026 Jan Engelhardt <jengelh@inai.de>
- Update to release 8.6.1
* msSLDParseRasterSymbolizer: fix potential heap buffer overflow
[boo#1260869] [CVE-2026-33721]
* GetFeatureInfo with IDENTIFY CLASSAUTO: take into account
SYMBOL.ANCHORPOINT
* WCS 2.0: fix issue when input raster in a rotated pole lon/lat
CRS with lon_0 > 180
* UVRaster: fix WMS-Time support on layers with TILEINDEX
pointing to a shapefile
* WMS GetCapabilities response: use group title and abstract when
using wms_layer_group instead of GROUP
* Mon Mar 02 2026 Jan Engelhardt <jengelh@inai.de>
- Update to release 8.6.0
* Add `CONNECTIONTYPE RASTERLABEL`
* Set `MS_LEGEND_KEYSIZE_MAX` to 1000
* Add 4 new `COMPOSITE.COMPOP` blending operations
* Allow encryption key files to use paths relative to a mapfile
* Allow `use_default_extent_for_getfeature` to be used for OGC
Features API and PostGIS
* Allow append of additional query parameters for OGCAPI
* New MapServer index page
* WMS `GetFeatureInfo`: add options to precisely identify points
through their symbols
* Add `FALLBACK` parameter for the `CLASS` object, to be applied
if none of the previously defined classes has been applied
* Sun Oct 13 2024 Jan Engelhardt <jengelh@inai.de>
- Update to release 8.2.2
* Use EPSGTreatsAsLatLong and EPSGTreatsAsNorthingEasting to
determine inverted axis
- Delete 0001-Fix-compilation-errors-with-libxml2-2.12.patch
(merged)
- Perform multipython build
* Mon Aug 19 2024 Jan Engelhardt <jengelh@inai.de>
- Add 0001-Fix-compilation-errors-with-libxml2-2.12.patch
* Fri Mar 01 2024 Dominique Leuenberger <dimstar@opensuse.org>
- BuildRequire proj-devel instead of the long deprecated name
libproj-devel.
* Wed Sep 13 2023 Dirk Stoecker <opensuse@dstoecker.de>
- update to 8.0.1
* PROJ_DATA set through config option: take into account
possibility of multiple paths separated by ; on Windows or : on
Unix
* Resolve a bunch of memory leaks, integer overflows, nullptr
dereferences, double-frees.
* Allow NULL shapes to be returned in WFS GetFeature requests
* Ensure POINT blocks do not contain too many points
* https://www.mapserver.org/development/changelog/changelog-8-0.html
* Sat Nov 05 2022 Jan Engelhardt <jengelh@inai.de>
- Enable PHP8 module build in Tumbleweed again since newer SWIG
is available. New subpackage php-mapscriptng emitted as a result.
[boo#1204736]
* Sat Oct 08 2022 Jan Engelhardt <jengelh@inai.de>
- Update to release 8
* MapServer now requires a config file. To get back mapserver7
behavior, copy /usr/share/doc/packages/mapserver/mapserver.conf
to mapserver.conf once.
* The shp2img utility has been renamed to map2img
* FlatGeobuf is now supported natively
* Initial OGC API support
* PHP native MapScript has been removed, in place of PHPNG
(SWIG) MapScript, and PHP unit tests have been re-enabled
* New labeling centerline GEOMTRANSFORM method for polygons
* Numerical validation of mapfile entries
* Removed various deprecated mapfile parameters
* New coshp utility to sort shapefile contents as well as sort
the associated qix spatial index.
- Drop mapserver-7.6.1-fix_python_install_path.patch
(no longer applicable)
* Tue Jul 26 2022 Boris Manojlovic <boris@steki.net>
- re-enable postgresql support...
* Wed Mar 09 2022 Jan Engelhardt <jengelh@inai.de>
- Make the package build on current Tumbleweed again:
* Disable PHP bindings (fails to build)
* Disable PostgreSQL (fails to configure)
- Have mapserver-devel require the accompanying library
* Thu Nov 11 2021 Boris Manojlovic <boris@steki.net>
- update to release 7.6.4
* PostGIS: fix ST_Intersects() with collections with PostGIS < 2.5.
Fixes https://github.com/MapServer/MapServer/pull/6355#issuecomment-877290417 (Even Rouault) : 3e42e35
* Check if sizeunits is not set to pixels (Patrik Sylve) : 3688004
* Change legend symbol scale factor when SIZEUNITS is set to METERS (Patrik Sylve) : 39a4ead
* spatialindex for sqlite sources in filter (Wouter Visscher) : 955d14e
* Make sure requested class with mode=legendicon is not negative. ( #6357 ) (Steve Lime) : 0901b57
* Updates to CONTRIBUTING.md (Jeff McKenna) : ee6297a
* PostGIS: fix ST_Intersects() with bounding box that is a point (follow-up of fixes #6181 , fixes #6230 )
(fixes https://github.com/MapServer/MapServer/pull/6347#issuecomment-870002856) (Even Rouault) : 44d5d9c
* WMS: make attribute color binding work with FILTER vendor parameter (fixes #6200 ) (Even Rouault) : 1a98ac7
* msQueryByFeatures(): avoid potential segfault when reslut set is empty (Even Rouault) : 98ad83a
* PostGIS: use ST_Intersects instead of && for bounding box (fixes #6181 , fixes #6230 ) (Even Rouault) : e2ef155
* check_single_font(): use quotation mark when msGetGlyphIndex() fails to retrieve the glyph (Even Rouault) : 53ee29e
* msGetGlyphByIndex() / msGetGlyphOutline(): tweak debug/error messages (Even Rouault) : 0bbf943
* When a font is missing a glyph we try to fallback to using a question mark (Krister Wicksell) : cf4756e
* WFS: fix paging with GPKG/Spatialite datasources and non-point geometries (fixes #6325 ) (Even Rouault) : ce8dc4d
* Fix querymap failure for polygon layers with labels only (no styles) ( #6262 ) (Tamas Szekeres) : 782ee8b
* mapxbase: validate nHeadLen (Max Kellermann) : ee5d5de
* mapshape, mapxbase: fix several memory leaks in error code paths (Max Kellermann) : 5e4c504
* mapshape: validate numshapes (Max Kellermann) : b5c0e29
* mapshape: remove useless null terminator (Max Kellermann) : 9755395
* Mon May 31 2021 Ferdinand Thiessen <rpm@fthiessen.de>
- Update to 7.6.3
* Security: Address flaw in CGI mapfile loading that makes it
possible to bypass security controls ( CVE-2021-32062 )
* Fix most of remaining Coverity scan warnings with high priority
* Use CPLSetConfigOption/CPLGetConfigOption for some
CGI/FastCGI-related env vars.
* Require url-based symbol values to be pre-defined.
* Improved initial check on generating reference maps,
avoid crash with label styles
* Fix resource leak and pointObj initialization errors.
- Enable python
- Refresh mapserver-7.6.1-fix_python_install_path.patch
* Mon Feb 01 2021 Jan Engelhardt <jengelh@inai.de>
- Update to release 7.6.2
* Contour layer: take into account nodata value from GDAL raster
* WCS 1.1 and 2.0: fix support of netCDF output
* Wed Jan 20 2021 Jan Engelhardt <jengelh@inai.de>
- Drop BuildRequires on binary library packages; this is wrong.
- Drop excessive runtime package requirements.
* Wed Dec 23 2020 Jan Engelhardt <jengelh@inai.de>
- Modernize and ready specfile for Factory
* Tue Sep 08 2020 Boris Manojlovic <boris@steki.net>
- add USE_PROJ to compile flags to enable reprojections (TILE support)
* Sat Sep 05 2020 Boris Manojlovic <boris@steki.net>
- updated to latest version 7.6.1
- fix building on opensuse leap 15.X
- added mapserver-7.6.1-fix_python_install_path.patch to fix
python install location defaulting to arch independent location
- a lot of changes between versions please look at:
https://mapserver.org/development/changelog/changelog-7-6.html#changelog-7-6
and at this location:
https://github.com/mapserver/mapserver/blob/branch-7-6/HISTORY.TXT
- security fixes from older versions: CVE-2020-10872 and CVE-2020-10873
* Fri May 17 2019 Dirk Stoecker <opensuse@dstoecker.de>
- update to version 7.4.0
* MS RFC 117: PHP 7 MapScript Support Through SWIG
* native support for PHP 7 through mapscript (461f827)
* Fix potential cross-site scripting (XSS) security issue with
[layers] tag
* enhanced support for Python 3 mapscript through SWIG
* Allow compiling with PROJ 6, but full PROJ 6 support will be
included in the future MapServer 8 release (#5766)
- Drop 5461.patch and cmake-3.12.patch included upstream
* Thu Sep 13 2018 Dirk Stoecker <opensuse@dstoecker.de>
- update to final release
- Fix build with newer cmake: cmake-3.12.patch
* Thu Jun 07 2018 opensuse@dstoecker.de
- update to 7.2.0-beta1 to support Leap 15.0
* Add 5461.patch to support PHP7
* support python3
* Fri Dec 15 2017 opensuse@dstoecker.de
- update to 7.0.7
* Wed Apr 05 2017 opensuse@dstoecker.de
- udate to Mapserver 7.0.4, drop all patches
* Tue Mar 08 2016 ralf.habacker@freenet.de
- Add xxxx-fix-python-mapscript-soversion-install-issue.patch to fix
broken installing of mapscript python module
- Exclude ruby from build for sles11 because of missing ruby dependencies
- Use ruby-common as build dependency instead of outdated ruby-macros
* Fri Feb 05 2016 guillaume@opensuse.org
- Fix build when 'php_mapscript.so' is only file installed and no
* .so.1 and *.so%{version} (Fix openSUSE 13.1 build)
* Fri Feb 05 2016 guillaume@opensuse.org
- Add giflib_5.1.0.patch to fix compilation with giflib 5.1.0+
- Add swig_3.patch to fix compilation with swig 3
* Sat Aug 30 2014 bruno@ioda-net.ch
- packaging spec-cleaner
- fixed compilation error with php 5.6.0
upstream patch 4912-php56-php-input.patch
supported also php 5.5x
- fixed blending tif error
upstream patch 4875-incorrect-blending-tif.patch
* Sun Mar 30 2014 bruno@ioda-net.ch
- use correct ruby rpm macros
* Thu Jan 02 2014 bruno@ioda-net.ch
- updated to upstream 6.4.1
http://mapserver.org/development/changelog/changelog-6-4.html#changelog-6-4-1
full list of changes in 6.4.1
- spec cleaning
- modified patches:
* 4788.patch (upstream issue 4788) SOVERSION in CMakefile
* 4788-php-mapscript patch for php versionning
* 4788-python-mapscript patch for python versionning
- deleted patches: (merged upstream)
* 4791.patch fix lib path install
* 4803.patch fix for force_st2d
* Mon Nov 18 2013 bruno@ioda-net.ch
- Added Requires proj (missing espg for tools otherwise)
- Added upstream #4803 patch forcest2d
* Thu Nov 14 2013 bruno@ioda-net.ch
- packaging : fix php mapscript name in mapscript.ini (symlink)
- Added upstream #4788 patch versionning php-mapscript
Fix by removing buggy pre-post script
- /srv/www/cgi-bin/ binaries as symlink to /usr/bin
* Sun Nov 03 2013 tzotsos@opensuse.org
- Some minor spec cleanup
* Sat Oct 26 2013 bruno@ioda-net.ch
- packaging fix tab
- packaging fix php-mapscript
rename php_mapscript.so to php_mapscript-%{version}.so
(upstream bug in 6.4.0)
remove post check which remove php_mapscript.so
* Sun Oct 13 2013 bruno@ioda-net.ch
- Use patch commit 4791 for fixing cmake_install_lib
- split libmapserver to its own package
could be used by mapscript module alone
- add rpmlintrc with explanation for warning removal
- Review licence part, description
- Remove apache2-mod_php5 dependency which block usage on fcgid
fastcgi mode
- Rename all mapscript package to fix naming policy and clarify
what they are
- Added ruby mapscript package
- Make all DWITH extension visible in the spec to be sure about
which one are activated or not
* Sun Apr 21 2013 tzotsos@opensuse.org
- Updated to v6.4.0 (see
http://mapserver.org/development/changelog/changelog-6-4.html#changelog-6-4-0
for a detailed description of the changes).
- Switched to CMake
* Sun Apr 21 2013 tzotsos@opensuse.org
- Updated to v6.2.1
* Move #4577 fixes out of libmapserver (2013-04-18 10:55:23 +0200 - Thomas Bonfort)
* Exposed labelObj.text and labelObj.expression in PHP/MapScript (closes #4310) (2013-04-16 13:41:18 +0000 - Alan Boudreault)
* Fixed problems found in the mapfile.xsd while trying to convert current mapfiles into xmlmapfiles (2013-01-30 09:45:41 -0700 - Alex Wells)
* Ensure that msCopyLabel copies expression and text directives (2013-02-20 09:02:56 +0000 - Homme Zwaagstra)
* Updated submodule for #4633 (2013-04-12 18:56:44 +0200 - Thomas Bonfort)
* Update submodule for backported fix of #4633 (2013-04-12 18:32:53 +0200 - Thomas Bonfort)
* OGR WFS output: do not force null integer values to 0 (#4633) (2013-04-12 00:57:27 +0200 - Even Rouault)
* Fix for WMS requests with width and height of 1 (#4629) (2013-04-11 19:30:25 +0200 - Thomas Bonfort)
* Parse key value pairs sent in POST body (#4627) (2013-04-04 12:49:37 +0200 - Martin Kofahl)
* Add a script to run full test suite (build + test run) (2013-04-11 10:22:00 +0200 - Thomas Bonfort)
* update autotest submodule for #4625 and #4624 (2013-04-09 13:17:05 +0200 - Thomas Bonfort)
* Use ows_schemas_location for sld_capabilities ref (#4624) (2013-04-08 20:38:40 -0400 - Tom Kralidis)
* Update msautotests for #4622 (2013-04-08 11:56:34 +0200 - Thomas Bonfort)
* Don’t entity-encode URLs used on attributes: libxml2 does this for us. Refs #4622 (2013-04-05 09:38:25 +0200 - ejn)
* Fix cgi label commands after multi-label changes (#4621) (2013-04-03 13:54:43 +0200 - Thomas Bonfort)
* Ignore additional encodings in received content-type headers (#4585) (2013-03-29 10:22:05 -0400 - Thomas Bonfort)
* Fix PHP building when GD is disabled. Closes #4550 (2013-03-28 16:53:07 -0400 - Thomas Bonfort)
* CAIRO renderer fails to render some truetype symbols (#4616) (2013-03-27 11:34:22 +0100 - szekerest)
* Fix mapfile writer to write SVG symbols (#4607) (2013-03-21 22:05:02 +0100 - szekerest)
* Fix issues with wms_layer_group printing (#4533) (2013-03-04 21:49:36 +0100 - szekerest)
* Write CLASS validation to mapfile (#4596) (2013-03-04 17:06:05 +0100 - Thomas Bonfort)
* Mark disabled layers as processed to prevent from being displayed in nested groups (#4533) (2013-03-03 19:25:25 +0100 - szekerest)
* Don’t write GRATICULE connectiontype (#4165) (2013-02-28 10:20:24 +0100 - Thomas Bonfort)
* Add validation block to copy functions (#4596) (2013-02-27 17:39:39 +0100 - Thomas Bonfort)
* Fix for the segfault with WMS TIME patterns (#3795) (2013-02-22 23:08:36 +0100 - szekerest)
* Fix for the problem with filter when using WMS TIME parameters (#3795) (2013-02-22 21:51:13 +0100 - szekerest)
* Fix for the unsupported geometry type problem (#4591) (2013-02-21 19:38:30 +0100 - szekerest)
* #4528 : support for running mapscript tests without having to install core mapserver (2013-02-14 15:03:09 +0100 - Umberto Nicoletti)
* Fix rectObj/sha