Skip to content
Octo × Web applications PT Request an assessment

Octo for MapGuide web applications

The viewer changes. Who decides what goes public is you.

MapGuide Open Source 4.0 shipped on Oct 12, 2025 with PHP 8, NuGet packages and a single jar for Java, and it still includes the AJAX and Fusion viewers. Octo inventories the published layouts, puts mapguide-react-layout next to the old ones, builds OpenLayers clients on mapagent and checks web-tier security by the content of the responses. Publishing, access profiles and retiring the old viewer stay with the administrator and the technical lead.

Request an assessment See what it does
A terminal asks mapagent for a session map and lists the published AJAX and Fusion layouts; Octo, in the center, carries the result to a browser window with a fictitious map of blocks, a highlighted selection and the new viewer's layer panel $ curl mapagent.fcgi \ OPERATION=CREATERUNTIMEMAP FORMAT=application/json CLEAN=1 "RuntimeMap": { "Name": "Cadastro" } WebLayout AJAX ApplicationDefinition Fusion InvokeURL to port VIEWERS ON THE SAME SERVER mapviewerphp · AJAX old fusion · ApplicationDefinition old viewer-0.14.10 · react-layout staging /mapguide/viewer/slate.html?resource=… Parcels Blocks River Owner restricted by profile SESSION in-house server → SESSION browser never sees a password AnonymousDeny… filled in ol/source/ImageMapGuide OCTO × MAPGUIDE WEB MapGuide OS 4.0 W-07 FICTITIOUS DATA
MapGuide Open Source4.0final release announced Oct 12, 2025
mapguide-react-layout0.14.10stable since Jan 15, 2025, MIT license
Sources13listed at the end of the page
01

What Octo does in the MapGuide web tier.

Six possible deliverables, drawn from the assessment. All of them start in staging, with the version of the server and of each viewer recorded, and all go to review by whoever is accountable for the server.

Viewer inventory

Lists every WebLayout (AJAX) and ApplicationDefinition (Fusion) in Library:// through mapagent, with the linked map, the template and the InvokeURL and InvokeScript commands that depend on in-house code.

Deliverable: spreadsheet by layout, without changing anything

Side-by-side viewer swap

Installs a pinned version of mapguide-react-layout in its own folder, which reads the same WebLayout and ApplicationDefinition, and tests each layout by the content of the response.

Deliverable: new viewer in staging + report

Porting panel tasks

Moves Web API tasks written for PHP 5.x to the PHP 8 in 4.0, Java code to the single MapGuideJavaApi.jar and .NET to the OSGeo.MapGuide.* NuGet packages.

Deliverable: tasks ported and tested with least privilege

OpenLayers or Leaflet client

A map inside your own portal: CREATERUNTIMEMAP, dynamic layer with ImageMapGuide, XYZ tile set basemap via GETTILEIMAGE and selection via QUERYMAPFEATURES.

Deliverable: JavaScript module + test script

Security check

Reads webconfig.ini (authoring, AnonymousDeny* lists, default WMS and WFS passwords, query limits) and tests, as Anonymous, whether the data source XML comes back.

Deliverable: list of alerts with the proposed fix

Session without a password in the browser

Your application authenticates the user and creates the MapGuide session on the server side; the browser receives only the SESSION, and each profile sees only its own layers.

Deliverable: session design and per-profile test
02

Eight arms, one checked viewer.

The same Octo cycle, applied to the MapGuide web tier. Each arm has a narrow role; the people decide what goes public, who sees each layer and when the old viewer goes offline.

  1. Discovery

    Maps what already exists

    Server, PHP, Java and NuGet package versions, installed viewers and every published WebLayout and ApplicationDefinition.

  2. Data

    Links layout to data

    Map, layers and sources for each layout, and which ones hold personal data (registry, health, social services).

  3. Security

    Handles access

    webconfig.ini, Anonymous, default users, HTTPS and panel tasks. Personal data stays in the client's environment and is assessed (LGPD) before it goes to any external service.

  4. Architecture

    Chooses the path

    AJAX, Fusion, mapguide-react-layout or a custom client; XYZ tiles or dynamic image; session created by your own server.

  5. Development

    Writes the code

    Inventory and test scripts, task ports to PHP 8, an OpenLayers module, with the source of every syntax noted in the file.

  6. Review

    Checks by content

    Page loaded, RuntimeMap returned, correct selection, test with the least-privileged profile. A 200 status is not a check.

  7. Release

    Delivers in staging

    Only with your OK, it puts the new viewer in a new folder. A person switches the public link.

  8. Documentation

    Records what holds

    Version of each viewer, package SHA-256, ported tasks, accepted alerts and who accepted them.

Octo works in staging and in a support role. It does not decide what is public, define access profiles, change the production server or retire a viewer without sign-off.

03

Each task, its own path.

The criteria Octo uses to choose, with the documentation for the installed version.

TaskPathNote
List published layoutsENUMERATERESOURCES with TYPE=WebLayout and ApplicationDefinitionRead-only
Read a viewer's configurationGETRESOURCECONTENTResource XML
Modern viewermapguide-react-layout viewer.zip, ?resource=Reads WebLayout and ApplicationDefinition; MIT
Session map for a custom clientCREATERUNTIMEMAP with REQUESTEDFEATURESBitmask: 1 layers, 2 icons, 4 sources
Dynamic layerol/source/ImageMapGuideuseOverlay, BEHAVIOR, ratio
Fast basemapGETTILEIMAGE with an XYZ tile set in Leaflet or OpenLayers{x} goes into TILEROW, on purpose
Select and read attributesQUERYMAPFEATURES with WKTPERSIST=1 saves to the session map
Panel taskWeb API in PHP 8, Java or .NETReceives SESSION and MAPNAME
.NET applicationNuGet OSGeo.MapGuide.* 4.0Experimental Linux in RC1
Check securitywebconfig.ini + GETRESOURCECONTENT as AnonymousContent check
04

From the legacy viewer to your own standard.

Three steps. Each one only makes sense after the previous one has shown results on your team.

A proposal, not a promise

1 Today

Inventory and check

Octo shows what is published and what the web tier leaves open, without touching anything.

  • Spreadsheet of layouts and in-house commands
  • webconfig.ini alerts
  • Read test as Anonymous
Benefit: know the size of the swap before starting
2 Next

New viewer in staging

mapguide-react-layout next to the old viewers, ported tasks and a smoke test per layout.

  • Pinned viewer version, with SHA-256
  • Panel tasks in PHP 8
  • Report by layout for the accountable person
Benefit: the team compares screens, not files
3 Later

Map inside the portal

Custom OpenLayers client on top of mapagent, with the session created by your own server and layers by profile.

  • Cached XYZ tile basemap
  • Selection and attributes by profile
  • Automated test on every upgrade
Benefit: the map becomes part of the service, not a separate page
05

Confirmed in a source.

Every point below has a source published by OSGeo (project page, official mailing lists, downloads area), by the official repository or by Autodesk. The examples are scripts, not executions. The sources are in the next section.

4

points with a published source, each with its reference shown alongside.

ConfirmedMapGuide Open Source 4.0
Final release announced on Oct 12, 2025 on the mapguide-users list.Source: mapguide-users list and maintainer's blog
ConfirmedRegenerated Web API
Bindings generated by the official SWIG, end of PHP 5.6, netstandard2.0 packages on NuGet and a single MapGuideJavaApi.jar.Source: 4.0 Preview 4 announcement (Nov 2022)
ConfirmedWeb-tier security keys
In the 4.0 branch webconfig.ini: DisableAuthoring = 0, empty AnonymousDeny* lists, WmsPassword = wms, WfsPassword = wfs and empty global query limits.Source: MapGuide SVN, 4.0 branch
Confirmedmapguide-react-layout
MIT, 0.14.10 stable from Jan 15, 2025, pre-release 0.15.0-pre.25 from Sep 29, 2026; reads WebLayout and Flexible Layout and requires MapGuide 3.0 or newer.Source: project repository (release notes) and npm registry
06

What Octo does and what stays with you.

Octo prepares everything, but it does not sign. The document of record stays with whoever is accountable for it.

Octo prepares

Gathers, calculates, organizes and generates the documents: scripts, inventories, reports and maps.

Deliverable: material ready to check

Your team checks

The licensed professional checks what Octo delivered before signing. If something doesn't add up, it goes back to Octo with the correction.

Step: review by the signer

The signer

Octo does not sign. Designs, technical reports, ART/RRT, accountability reports and any official document are still signed by the licensed professional of the company or agency: here, the technical lead for the map or system.

Signature: technical lead for the map or system
07

Sources.

OSGeo pages, mailing list, SVN and blog of the MapGuide maintainer, the mapguide-react-layout repository and the npm and NuGet registries, consulted on Oct 31, 2026.

Your maps on the web, checked layout by layout.

The assessment starts with an inventory of the published viewers and a check of the web tier, without touching anything. You get the list of what to swap, the security alerts and the questions only your team can answer, and you decide with it in hand.

Request an assessment