Merge pull request #66 from MetOffice/develop

Release 19/07/2023

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+# GitHub Code Owners Configuration
+
+# All files owned by the Data Services - Jaguar GitHub Organisation Team
+* @MetOffice/data-services-jaguar

.gitignore

@@ -11,4 +11,5 @@
 /derby.log
 /cookie-jar
 .vagrant
-/war/ROOT.war
+/war/ROOT.war
+.idea

ldregistry/config/app.conf

@@ -62,7 +62,7 @@ config.oauth2        = $oauth2
 
 # The Registry configuration itself
 registry             = com.epimorphics.registry.core.Registry
-registry.baseUri     = http://codes.wmo.int/
+registry.baseUri     = http://codes.wmo.int
 registry.store       = $storeapi
 registry.cacheSize   = 100
 registry.pageSize    = 9000

ldregistry/config/language/messages/en.properties

@@ -63,7 +63,7 @@ checkUri.label=Check URI
 checkUri.heading=Check whether a URI is registered
 checkUri.button=Check
 checkUri.uri=URI to check
-checkUri.notFound=<strong>Not found.</strong> URI <{0}> does not seem to be registered.
+checkUri.notFound=<strong>Not found.</strong> Sorry, the requested URI was not found on this site.
 checkUri.registered=URI is registered:
 
 compare.item.new.label=New
@@ -77,7 +77,7 @@ error.heading=Sorry
 error.internal.title=Internal error {0}
 error.internal.description=Sorry, an internal error has occurred.
 error.notFound.heading=Not found (404)
-error.notFound.note=Sorry, the URI <a href="{0}">{1}</a> was not found on this site.
+error.notFound.note=Sorry, the requested URI was not found on this site.
 
 footer.support.heading=Support
 footer.about.heading=About this page

ldregistry/templates/about/expectations.vm

@@ -15,14 +15,14 @@
       <div class="row">
 
 <p>
-The WMO Codes Registry is the mechanism through which the authoritative terms required for <a href="http://wis.wmo.int/page=AvXML-1">WMO AvXML</a> are published as web accessible resources.
+The WMO Codes Registry is the mechanism through which the authoritative terms required for <a href="https://old.wmo.int/wiswiki/tiki-index.php%3Fpage=AvXML-1&structure=WIS+up.html" target="_blank">WMO AvXML</a> are published as web accessible resources.
 </p>
 
 <p>
-The <a href="http://www.metoffice.gov.uk">Met Office</a> operates this service on behalf of <a href="http://www.wmo.int">WMO</a>.  The Met Office does not anticipate that operational services will have a direct dependency on this service and therefore does not offer any assurances regarding the availability or accuracy of the service.
+The <a href="https://www.metoffice.gov.uk" target="_blank">Met Office</a> operates this service on behalf of <a href="https://www.wmo.int" target="_blank">WMO</a>.  The Met Office does not anticipate that operational services will have a direct dependency on this service and therefore does not offer any assurances regarding the availability or accuracy of the service.
 </p>
 <p>
-The Met Office aims to ensure that information provided within the service is accurate, albeit incomplete in comparison to the scope of the WMO Technical Regulations. The initial set of authoritative terms is deemed sufficient to support the <a href="http://wis.wmo.int/page=AvXML-1">WMO AvXML data exchange standard</a>. It is anticipated that the scope of content available through this service will expand during the life of the service.
+The Met Office aims to ensure that information provided within the service is accurate, albeit incomplete in comparison to the scope of the WMO Technical Regulations. The initial set of authoritative terms is deemed sufficient to support the <a href="https://old.wmo.int/wiswiki/tiki-index.php%3Fpage=AvXML-1.1-Packages.html" target="_blank">WMO AvXML data exchange standard</a>. It is anticipated that the scope of content available through this service will expand during the life of the service.
 </p>
 <p>
 Contributions are encouraged from interested parties, see <a href="/ui/about/contributing">contributing to the content of the WMO Codes Registry service</a> for more details.  For example, the site is not yet multi-lingual.
@@ -32,23 +32,23 @@ Contributions are encouraged from interested parties, see <a href="/ui/about/con
 The Met Office will endeavour that the service is available, 24 hours a day, 7 days a week. In the event of a system fault, the Met Office will endeavour to restore the system to normal operation. There is no provision of an alternative service should the service be unavailable.
 </p>
 <p>
-The WMO provides a Google Group (<a href="http://www.google.com/url?q=https%3A%2F%2Fgroups.google.com%2Fa%2Fwmo.int%2Fforum%2F%3Fhl%3Den-GB%23!forum%2Fcbs-codes-registry">WMO Codes List Registry</a>) for discussion about the service and content provided.
+The WMO provides a Google Group (<a href="http://www.google.com/url?q=https%3A%2F%2Fgroups.google.com%2Fa%2Fwmo.int%2Fforum%2F%3Fhl%3Den-GB%23!forum%2Fcbs-codes-registry" target="_blank">WMO Codes List Registry</a>) for discussion about the service and content provided.
 </p>
 <p>
-If you encounter technical issues, please contact the <a href="http://www.metoffice.gov.uk/about-us/contact">Met Office Weather Desk</a> during UK business hours. 
-For technical information about the Registry software implementation and API, please refer to the documentation provided at the <a href="https://github.com/der/ukl-registry-poc/wiki">UKGovLD Registry project wiki</a> (note that the UKGovLD Registry software and API are open source and published under the <a href="http://www.apache.org/licenses/LICENSE-2.0.html">Apache 2 license</a>).
+If you encounter technical issues, please contact the <a href="https://www.metoffice.gov.uk/about-us/contact" target="_blank">Met Office Weather Desk</a> during UK business hours. 
+For technical information about the Registry software implementation and API, please refer to the documentation provided at the <a href="https://github.com/UKGovLD/registry-core" target="_blank">UKGovLD Registry project wiki</a> (note that the UKGovLD Registry software and API are open source and published under the <a href="http://www.apache.org/licenses/LICENSE-2.0.html" target="_blank">Apache 2 license</a>).
 </p>
 <p>
-The information provided by the service will be maintained by nominated members of WMO Expert Teams and the <a href="https://www.wmo.int/pages/prog/www/WDM/wdm.html">WMO Secretariat</a>. To request the provision of additional content from WMO Technical Regulation to be published via this service please post to the <a href="http://www.google.com/url?q=https%3A%2F%2Fgroups.google.com%2Fa%2Fwmo.int%2Fforum%2F%3Fhl%3Den-GB%23!forum%2Fcbs-codes-registry">WMO Codes List Registry group</a>. 
+The information provided by the service will be maintained by nominated members of WMO Expert Teams and the <a href="https://old.wmo.int/wiswiki/tiki-index.php%3Fpage=CBS-16-Secretariat&structure=WIS+up.html" target="_blank">WMO Secretariat</a>. To request the provision of additional content from WMO Technical Regulation to be published via this service please post to the <a href="http://www.google.com/url?q=https%3A%2F%2Fgroups.google.com%2Fa%2Fwmo.int%2Fforum%2F%3Fhl%3Den-GB%23!forum%2Fcbs-codes-registry" target="_blank">WMO Codes List Registry group</a>. 
 </p>
 <p>
-To notify the service administrators of inappropriate information, please contact the <a href="http://www.metoffice.gov.uk/about-us/contact">Met Office Weather desk</a>.
+To notify the service administrators of inappropriate information, please contact the <a href="https://www.metoffice.gov.uk/about-us/contact" target="_blank">Met Office Weather desk</a>.
 </p>
 <p>
-To notify the service administrators of erroneous information, please post to the <a href="http://www.google.com/url?q=https%3A%2F%2Fgroups.google.com%2Fa%2Fwmo.int%2Fforum%2F%3Fhl%3Den-GB%23!forum%2Fcbs-codes-registry">WMO Codes List Registry group</a>.
+To notify the service administrators of erroneous information, please post to the <a href="http://www.google.com/url?q=https%3A%2F%2Fgroups.google.com%2Fa%2Fwmo.int%2Fforum%2F%3Fhl%3Den-GB%23!forum%2Fcbs-codes-registry" target="_blank">WMO Codes List Registry group</a>.
 </p>
 <p>
-The primary purpose of this service is to support the new data exchange standard developed by WMO in support of Amendment 76 to ICAO Annex 3 "Meteorological services for International Air Navigation". This new data exchange standard (<a href="http://wis.wmo.int/page=AvXML-1">WMO AvXML</a>) enables exchange of operational aeronautical meteorological (OPMET) in XML format. It depends on availability of authoritative terms from WMO technical regulation - most notably <a href="http://www.wmo.int/pages/prog/www/WMOCodes.html">WMO No. 306 Manual on Codes</a> - as web accessible resources that can be referenced from WMO AvXML-compliant data products. 
+The primary purpose of this service is to support the new data exchange standard developed by WMO in support of Amendment 76 to ICAO Annex 3 "Meteorological services for International Air Navigation". This new data exchange standard (<a href="https://old.wmo.int/wiswiki/tiki-index.php%3Fpage=AvXML-1&structure=WIS+up.html" target="_blank">WMO AvXML</a>) enables exchange of operational aeronautical meteorological (OPMET) in XML format. It depends on availability of authoritative terms from WMO technical regulation - most notably <a href="https://old.wmo.int/wiswiki/tiki-index.php%3Fpage=ManualCodes3.html" target="_blank">WMO No. 306 Manual on Codes</a> - as web accessible resources that can be referenced from WMO AvXML-compliant data products. 
 </p>
 
       </div>

ldregistry/templates/about/querying.vm

@@ -3,32 +3,55 @@
 
 <div class="jumbotron">
   <div class="container">
-    <h1>Populate Contents Tutorial</h1>
+    <h1>Query Registry Contents Tutorial</h1>
   </div>
 </div>
 
 <p>This is a developer tutorial, demonstrating how one may use information from the registry
   within other implementations.</p>
 
 <p>Contents of a registry may be used as structured information. The registry provides a
-  query endpoint where queries using the W3 SPARQL query language may be run.</p>
+    query endpoint where queries using the
+    <a href="https://www.w3.org/TR/sparql11-query/" target="_blank">W3C SPARQL query language</a> may be run.</p>
 
-<p>For example, JavaScript may be written to target the service query endpoint and
-  run a query that obtains all the registers and the current version
+<p>For example, JavaScript may be written to target the service query (<code>/system/query</code>) endpoint and
+  run a query that obtains all the elements within a specific register and the associated labels for each element.
 </p>
 
 <pre>
 let endpoint = "/system/query";
-let query = "prefix version: <http://purl.org/linked-data/version#>
-            prefix reg: <http://purl.org/linked-data/registry#>
-            select * where {
-            ?register a reg:Register; version:currentVersion ?regVer.} limit 10"
+let query = "PREFIX rdfs: &#60;http://www.w3.org/2000/01/rdf-schema#&#62;
+                PREFIX reg: &#60;http://purl.org/linked-data/registry#&#62;
+                PREFIX version: &#60;http://purl.org/linked-data/version#&#62;
+                SELECT ?regdef ?label WHERE {
+                ?item reg:register &#60;http://codes.wmo.int/49-2/AerodromeRecentWeather&#62; ;
+                    version:currentVersion/reg:definition/reg:entity ?regdef ;
+                    version:currentVersion ?itemVer .
+                ?regdef rdfs:label ?label . } LIMIT 10"
+</pre>
+
+<p>The query above obtains the identifying URI and associated label text for each member of the
+    <code>DataCategories/data-types</code> register of terms.
+</p>
+
+<p>There is a SPARQL interface available from the _Advanced_ menu, which you can use to
+    experiment with queries and responses. You can try copying this query and running it
+    through the query web interface page, and also adapting query syntax to meet your needs.
+</p>
+
+<p>
+  A JavaScript function can be provided to run the query on the endpoint and return
+  results that may be processed and presented, used in forms, and applied to other aspects of user
+  interaction. In this example, an HTML <code>div</code> container is created as the location for the output.
+</p>
+
+<pre>
+    &#60;div id="results"&#62;&#60;/div&#62;
 </pre>
 
 <p>
-  A javascript function can be provided to run the query on the end point and return
-  results that may be processed and presented, used in forms, and applied to other aspects
-  of user interaction.
+  This example creates an HTTP Request against the endpoint, checks for an OK (HTTP 200) response,
+  and sends the response content to a callback method.
 </p>
 
 <pre>
@@ -38,25 +61,25 @@ function sparqlQueryJson(queryStr, endpoint, callback) {
     // Build the request URI
     let requestUri = endpoint + "?query=" + escape(queryStr) + "&output=json";
 
-    // Get our HTTP request object.
+    // Get our HTTP request object
     if (window.XMLHttpRequest) {
         let xhr = new XMLHttpRequest();
         xhr.open('GET', requestUri, true);
 
-        // Set up callback to get the response asynchronously.
+        // Set up callback to get the response asynchronously
         xhr.onreadystatechange = function () {
             if (xhr.readyState === 4) {
                 if (xhr.status === 200) {
                     // Do something with the results
                     callback(xhr.responseText);
                 } else {
-                    // Some kind of error occurred.
+                    // Some kind of error occurred
                     alert("Sparql query error: " + xhr.status + " " + xhr.responseText);
                 }
             }
         };
 
-        // Send the query to the endpoint.
+        // Send the query to the endpoint
         xhr.send();
     } else {
         divResults.innerHTML = "Your browser does not support XMLHttpRequest";
@@ -65,29 +88,39 @@ function sparqlQueryJson(queryStr, endpoint, callback) {
 </pre>
 
 <p>
-  Defining a callback function in the script to process results provides easy access to
-  information from the register.
+  Defining a callback function in the script to process results provides easy access to information
+  from the register. The JavaScript below loops through the results of the SPARQL query and outputs
+  them as rows in an HTML table. Actual usage would depend on the context and usage profile, which
+  is likely not a plain html table of elements but the general principle remains.
 </p>
 
 <pre>
 function myCallback(str) {
     // Convert result to JSON
     let jsonObj = eval('(' + str + ')');
 
-    // Build up a table of results.
+    // Build up a table of results
     let table = document.createElement("table");
     table.className = "table table-striped table-bordered datatable dataTable";
 
+    // Create table head
+    let tableHead = document.createElement("thead");
+    table.appendChild(tableHead);
+
     // Create column headers
-    let tableHeader = document.createElement("tr");
+    let tableHeadRow = document.createElement("tr");
 
     for (let dataColumn of jsonObj.head.vars) {
         let th = document.createElement("th");
         th.appendChild(document.createTextNode(dataColumn));
-        tableHeader.appendChild(th);
+        tableHeadRow.appendChild(th);
     }
 
-    table.appendChild(tableHeader);
+    tableHead.appendChild(tableHeadRow);
+
+    // Create table body
+    let tableBody = document.createElement("tbody");
+    table.appendChild(tableBody);
 
     // Create result rows
     for (let dataRow of jsonObj.results.bindings) {
@@ -100,7 +133,7 @@ function myCallback(str) {
             tableRow.appendChild(td);
         }
 
-        table.appendChild(tableRow);
+        tableBody.appendChild(tableRow);
     }
 
     // Append the table to the results HTML container
@@ -110,7 +143,7 @@ function myCallback(str) {
 </pre>
 
 <p>
-  Finally, call the sparqlQueryJson method to initiate the query.
+  Finally, call the <code>sparqlQueryJson</code> method to initiate the query.
 </p>
 
 <pre>
@@ -119,19 +152,18 @@ sparqlQueryJson(query, endpoint, myCallback);
 
 <p>
   Queries may be structured to deliver the information required for a particular use case,
-  based on knowledge of the
-  targeted register information.
+  based on knowledge of the targeted register information.
 </p>
 
 <h2>Example Results</h2>
 <p>
-  Results from this example are presented below. 'browse source' on this page to see this
-  working example code set out.
+    Results from this example are presented below.
+    <a href="/ui/assets/js/querying-example.js" target="_blank">See the full working example</a>.
 </p>
 
 <div id="results">
   It may take a few moments for the info to be displayed here...
 </div>
 
 #set($extraJS="querying-example.js")
-#parse("structure/_footer.vm")
+#parse("structure/_footer.vm")

ldregistry/templates/actions/_form-for.vm

@@ -3,7 +3,7 @@
 ## $register   - the register to which the form should be sent
 ## $return     - URL to return to 
 
-<form class="ajax-form" action="$register" method="post" data-return="$return" id="create-entry-form">
+<form class="ajax-form" action="$lib.reg.xssCleanHTMLAtribute($register)" method="post" data-return="$lib.reg.xssCleanHTMLAtribute($return)" id="create-entry-form">
   <input type="hidden" name="form-type" value="$spec.uRI" />
 
   <p>

ldregistry/templates/actions/_set-status-dialog.vm

@@ -15,6 +15,7 @@
         }
         $.ajax(action,{
             type : "POST",
+            contentType : "application/x-www-form-urlencoded; charset=UTF-8",
             success :
               function(data, status, xhr){
                 $("#status-dialog").modal("hide");

ldregistry/templates/actions/create-manual-page.vm

@@ -5,11 +5,15 @@
 
 #parse("structure/_preamble.vm")
 
+#if(! $subject.isAuthenticated())
+  <h1>Not authenticated</h1>
+#else
+
 <div class="row">
     <div class="col-md-10 col-md-offset-1 modal-page-panel">
 
         <div class="modal-page-head">
-            <h3>$msg.get('registerItem.createManual.heading', $register)</h3>
+            <h3>$msg.get('registerItem.createManual.heading', $lib.reg.xssCleanHTML($register))</h3>
         </div>
 
         <div class="modal-page-body">
@@ -37,7 +41,7 @@
         </div>
 
         <div class="modal-page-footer">
-            <a href="$return" class="btn pull-right">$msg['ui.close']</a>
+            <a href="$lib.reg.xssCleanURI($return)" class="btn pull-right">$msg['ui.close']</a>
         </div>
 
     </div>
@@ -64,5 +68,7 @@
     });
 
    </script>
-
+
+#end ## auth check
+
 #parse("structure/_footer.vm")

ldregistry/templates/actions/create-redirect-page.vm

@@ -5,11 +5,16 @@
 
 #parse("structure/_preamble.vm")
 
+
+#if(! $subject.isAuthenticated())
+  <h1>Not authenticated</h1>
+#else
+
 <div class="row">
     <div class="col-md-10 col-md-offset-1 modal-page-panel">
 
         <div class="modal-page-head">
-            <h3>$msg.get('redirect.heading', $entity)</h3>
+            <h3>$msg.get('redirect.heading', $lib.reg.xssCleanHTML($entity))</h3>
         </div>
 
         <div class="modal-page-body">
@@ -20,11 +25,13 @@
 
 
         <div class="modal-page-footer">
-            <a href="$return" class="btn pull-right">$msg['ui.close']</a>
+            <a href="$lib.reg.xssCleanURI($return)" class="btn pull-right">$msg['ui.close']</a>
         </div>
 
     </div>
 </div>
 <div class="modal-backdrop in"></div>
 
+#end ## auth check
+
 #parse("structure/_footer.vm")