Best place to process a URL parameter

[Keith]

I want my application to be accessed in two ways: a 'normal' user starts with a standard IP or domain name but a 'guest' (with restricted capabilities) starts with a URL parameter, say, ?bus=area1 (bus can take a variety of values which designate an area of activity).

In the NewSession procedure I set the bus session variable to 'normal'.  In the ProcessLink procedure I test for the presence of a variable and create the bus session variable viz:

  if p_web.IfExistsValue('bus')
     p_web.StoreValue('bus')
  END   

I the value of 'bus' is 'normal' then in later Process link code I do something but if it's not then I do other things.  However, 'bus' looks as if its getting reset to 'normal' after starting off as 'area1'. 

Have I done the right thing as regards the variable in the NewSession and ProcessLink code?

Something is obviously wrong because as I run thru the menus etc I get strange behaviour.  If I run the app with no starting variable it works fine.

Thanks

Keith

[kevin plummer]

Hi Keith,

I think you should be re-thinking your design. What Bruce was saying in his post yesterday was avoid unnecessary code in the process link method (as you pointed out it gets called lots of times) and will just ultimately slow your program down. I only add my DBOwner code in the process link method.

For restricting access for different types of users to menu's etc I set this up at the login screen and then use the session variable set to hide menu options etc via the templates.

Cheers,

Kev

[Keith]

Thanks Kevin

The only code that I have in ProcesLlInk is that which sets the file names for the tables for example:

     FIL:Customers  = p_web.gsv('filepath') & p_web.GSV('username') & '\Customers.tps'

and I think that this is the recommended place.

When the app is started 'normally' (no URL parameter), the user has to login and their login credentials allow me to set 'username' (see above).

For the case where the app is started with a parameter then my code logs them on automatically and the parameter is used to set 'username'.

However, as I have said I the code gets into a pickle and it looks as if the mode is somehow getting back to 'normal'.  So my question was whether initially setting 'bus' in NewSession to 'normal' and modifying it in ProcessLink, if there is a parameter,r was rigorous (it seems not).

My specific worries are:

1.  Does NewSession only ever get called once during a session (at the very start)?
2.  Could the fact that the URL changes during processing to not having a parameter cause a problem.

Where do you handle a parameter?

Thanks

Keith

[kevin plummer]

Hi Keith,


For the case where the app is started with a parameter then my code logs them on automatically and the parameter is used to set 'username'.

> the page that is started with the para is where you would set the session value and there would be no need to use the para again. This is where I would be checking to make sure the username session and loggedin variables are set.

[Bruce]

let's cover some basics;

  if p_web.IfExistsValue('bus')
     p_web.StoreValue('bus')
  END   

should be

  p_web.StoreValue('bus')

the test is done internally in that method, so is redundant here.

>> I want my application to be accessed in two ways: a 'normal' user starts with a standard IP or domain name but a 'guest' (with restricted capabilities) starts with a URL parameter, say, ?bus=area1 (bus can take a variety of values which designate an area of activity).

I'm not sure if you're meaning this as a security device, or as purely a convenience - but hopefully you've noticed that for someone to remove the data in the URL would be trivial? Typically systems that allow "logged in" users, and "guests" just require a login, but publish a "guest" login on the logging page for the user to use.

In ProcessLink are you testing for GetValue('bus') or GetSessionValue('bus') ?

Cheers
Bruce

[Keith]

Thanks for comments.

I originally coded p_web.StoreValue('bus') but changed it to the IfExistsValue('bus') because I wasn't sure about what happened when the URL changed and the parameter wasn't there. I do check GetSessionValue('bus').

The idea behind the parameter was that the address of the site would be in a link on the current web page of the business.  Typically these businesses have static web pages with a 'get in touch with us if you want to make a booking' blurb.  In this case we could add the link to my application - http://<domain name>:port?bus=fred where 'fred' was the code to allow setup of the full filepath to the business' data and then by logging the person on with appropriate Level I can restrict their activity to entering a Form and getting a Quote.  If they liked the quote then it would be available to the business to turn into a real booking.

I have spent so much effort on this already that I am determined to find out precisely what is happening and how this session variable is getting changed and I have already learned a lot so far.

But the suggestions both of you have made are useful and if I did forget this automating of the login I am sure that the 'guest' could login ok with a special userid and password and everything would work perfectly and that may be the most practical thing to do.

Thanks for your patience.

Keith

[Keith]

Ok, I have isolated the problem.

I get 'invalid' file name' because the NewSession procedure gets invoked in the middle of a current session.  This upsets my logic and the file names don't get set in ProcessLink.

My assumption was that NewSession was invoked only once per session.

With all of my testing without a URL parameter, NewSession is executed once.  When I invoke the application via a URL with parameter (?bus=bill) and I get to a specific point in my activity (just having made a Lookup selection) the app executes NewSession, the filenames don't get set and the error occurs.

I use this particular Lookup and use the same lookup procedure in another place without problems.

Looking forward to your comments.

Keith

[Keith]

Hi

I have attached an application which exhibits the behaviour I have been describing.

1.  Start with http://127.0.0.1:8094
2.  Login as bill/bill
3.  Take the 'get a Quote' menu item and Quote form will be displayed with some fields primed.
4.  Click the lookup button on the Service field
5.  A browse of Services will be displayed
6.  Select one and the description field will be filled

This is all good.

Now:

1.  Start with http://127.0.0.1:8094?bus=bill
2.  Take the 'get a Quote' menu item and A Quote form will be displayed with some fields primed.
4.  Click the lookup button on the Service field
5.  A browse of Services will be displayed
6.  Select one and the description field will not be filled
7.  Click the Lookup button again and the browse will display 'No Services'

This last event is because the file path for the services file is missing the 'bill' folder I think because the username session value is blank because NewSession has been executed.


About Files

All of the Filenames are controlled by variables.  In the folder with the executable there is Control.tps which has a record with the base file path (in my case 'c:/PetMotel/').  If you can put the files there then good otherwise you will need to modify the location with tpsscan.  Then dump the Files.zip content into that directory i.e.

<drive>/PetMotel/Bill and you should also get the Clients.tps file in <drive>/PetMotel

I am using NT8.27

Thanks very much for any attention anyone can give to this.

Keith



[attachment deleted by admin]

[Bruce]

hi Keith,

please note - when uploading examples - there is no need to include files which serve just to bloat the size of the attachment. App and Dct files are required, yes, and some data - but including the whole web folder, or DLL's & EXE etc is not ideal.

We have limited disk space on the forum server, and large uploads like this just serve to clutter it up.

(I have the example now, so don't repost - just be aware of it for next time please.)

cheers
Bruce

[Bruce]

Hi Keith,

I'm not sure I understand your strategy, so take this with a pinch of salf, but here are some comments just from looking at the code;

Webhandler;

a) you're setting values when the session is created - and that's fine I suppose, but you can skip over this step by just treating the "blank" value as the "starting point".
eg there's no need to set SSV('bus','normal') - just assume that if it's blank, then it's normal.

b) In ProcessLink you're testing the value of 'bus' but then not setting it. ie you are re-doing the code inside the IF for every single request. To me it _looks_ like it only needs to run if the user is not logged in, so perhaps the expression should be

if p_web.GSV('bus') not= 'normal' and p_web.GetSessionLoggedIn = 0

cheers
Bruce

[Keith]

Hi Bruce, thanks for looking at this.

Yes, I knew that theoretically if the URL parameter wasn't present then it would be blank etc but I put the 'normal' setting in the session variable because I was grasping at straws to understand what was happening and wanted to make absolutely sure that there were two separate modes.

My strategy is to allow Joe Public access to the program (and specific client database) with limited rights.  So if the parameter 'bus' has a value (it defines the particular client database) then I automatically log the user on with Level = 1 which allows me to restrict access.

Otherwise, clients themselves will login and get their Level set based on the Login Form and their own access.

I am happy with the strategy but when I use the parameter it just doesn't work because the file names get blanked which I suspect is because NewSession is executed in the middle of the current session.  When I login normally everything works perfectly.

I presume that you will go thru my two use cases and tell me what you think.

Thanks

Keith

[Bruce]

Hi Keith,

I think you're being confused by the NewSession code. Get rid of that completely and that will let you focus on what is actually happening.

NewSession is called when new sessions are created. Hence by definition whatever you do there will not affect any existing sessions, it will  merely add a session value to the new session.

So I think you're completely off track here at the moment. I recommend you refactor your solution so there is no code in newSession.

cheers
Bruce

[Keith]

Hi Bruce

I have removed the code in 'NewSession' that related to the URL parameter.

The problem persisted and I did more testing.  The situation in the code now is:

• The parameter (bparm) is not initialised
• bparm is set via: p_web.StoreValue('bparm') in the ProcessLink Procedure
• bparm is not altered in any other code

The assumption in the above code is that if the parameter exists then the session variable 'bparm' is stored via StoreValue and if it is not present then it is blank.  Another assumption is that if it was present at the start of a session then the session variable remains at the initial value even when the URL changes. 

Well, it looks to me as if this is not always the case.  When starting the session with ?bparm=bill I included the following in ProcessLink:

  stop('b4 store='&p_web.GSV('bparm'))
  p_web.StoreValue('bparm')    !save any URL parameter
  stop('after store='&p_web.GSV('bparm'))

The result is that frequently the first STOP displays 'bill' and the second displays blank.

I say 'frequently' because the ProcessLink procedure is executed a lot  and sometimes I correctly get bill/bill and sometimes bill/blank.  Sometimes I get bill/blank then blank/bill.

Now, once bill becomes blank my file path names get screwed up.

Of course, as noted before, if I execute without the parameter everything is ok because the pathname is being set thru a login procedure which is not dependent on the parameter.

It looks to me as if the problem is in StoreValue which sounds crazy I know but I cannot get any more granular in my investigation.

Your sage thought appreciated as always.

Keith