• Replies 2 replies
  • Subscribers 0 subscribers
  • Views 12 views
  • Users 0 members are here
Options
3sides - Social sharing widget
Related

Appliance syncing with parameters and site templates

David Furler
27246

Hi

We are looking to roll out a large amount of client sites via a site template and an iSheet that uses a client number parameter to filter results returned from a SQL view that is synced via Appliance.

It seems however that when deploying the template, the client parameter in the template is not deployed to the new site.

I had thought we would just add a dummy client number into the iSheet template, so when a site is deployed it wouldn't return any records until that client parameter is changed.

However as this parameter is not 'baked in' or 'required', it seems far too dangerous to have this parameter forgotten and the view relying on client number as a WHERE clause not being present so the new site starts to grab all records regardless of client number when it starts to sync.

We haven't done this before, but it seems to me this would be a common use case so I am wondering what we are missing here?

Any help on how this is normally done appreciated!

Thanks,
David

  • Your code could check if the ID is blank and if so just don't send the request, however based on what you've said I'd suggest rethinking this process, relying on the validity of an ID number being passed essentially by the user in the form of a client ID and then just returning data without checking they should have access seems like a potential for a huge data breach.

  • Hi Ryan

    Thanks for your response. I was a bit unsure whether to post this in Community or Developer, but I thought the Appliance app was a bit more on the back end side than end user. We don't actually use any code to use this app, it's supplied by HighQ and is sort of middleware between HighQ and internal systems.

    So on the HighQ side there is no code, and no code in the Appliance app (hosted on prem) besides a basic WHERE clause that can use one or more "input parameters" built into both Appliance and the iSheet admin, and then also on site creation by a site admin.

    While this parameter is only entered on the admin side, and our clients would not have admin access, I agree with your comments about the possibility of a huge data breach. Which is why I am scratching my head wondering if this is really the way it is. I'm still waiting on a reply from HighQ support, I've asked for anyone on the team who is familiar with the HighQ Appliance app. On the forums I'm guessing the expert is Imran Aziz, so I was hoping he would jump in with some best practice, or at least confirmation that we aren't missing something in our conclusion that there is no way to stop all records being delivered if somehow someone misses manually inputting the parameter into the field on site creation.

    Thanks,
    David