Information Systems:Web Orders Security - Revision history

Norwinu: Text replacement - "Category: Network Security" to "Category: Network and System Security"

2016-06-30T18:00:47Z

Text replacement - "Category: Network Security" to "Category: Network and System Security"

Norwinu at 16:16, 30 June 2016

2016-06-30T16:16:40Z

Norwinu at 16:00, 23 June 2016

2016-06-23T16:00:33Z

New page

=Users=

Web Orders uses a file, as we don’t want to add all those users to the i. Because of the limited opportunity for the user to do anything bad, the security requirement is nowhere near that of InfoNet. An unauthorised user would be able to place an order, but they would not be able to change the delivery address.

None of the programs are storing cookies on the user’s PC – server side cookies (called SMURFS) are used.

InfoNet and Web Orders have been made invulnerable to SQL injection attacks. This is done by looking at every selection field a user keys in, and removing all single quotes. This makes it impossible to, for example, search for BOB’S within a partner name; but it also makes it impossible for a malicious user to hijack the SQL statement that is constructed by the program based requests from the user.

=User Authorities=

In the Web Orders user file (WSUSERP), are fields that control what functions the user can access. uniPHARM can maintain this through 'work with partners' in InfoNet, or an authorized person at the store can do it through WebOrders / Site Admin / Manage Users.

[[File:WebOrders-1.jpg]]

Some of these authorities are only available for shareholders and staff; not for customers.

=Pharmacist Number=

Notice that in 'User details' there is a field for Pharmacist number. When there are controlled narcotics on the order, a pharmacist number has to be included. It can either be entered manually, or come from the user details.

[[Category: Network Security]]
[[Category: Web Orders]]

Sheilav at 23:48, 21 October 2015

2015-10-21T23:48:50Z

Sheilav at 23:38, 21 October 2015

2015-10-21T23:38:17Z

Sheilav at 23:17, 21 October 2015

2015-10-21T23:17:10Z

Sheilav: Created page with "Web Orders uses a file, as we don’t want to add all those users to the i. Because of the limited opportunity for the user to do anything bad, the security requirement is no..."

2015-10-21T23:07:28Z

Created page with "Web Orders uses a file, as we don’t want to add all those users to the i. Because of the limited opportunity for the user to do anything bad, the security requirement is no..."

New page

Web Orders uses a file, as we don’t want to add all those users to the i. Because of the limited opportunity for the user to do anything bad, the security requirement is nowhere near that of InfoNet. An unauthorised user would be able to place an order, but they would not be able to change the delivery address.

None of the programs are storing cookies on the user’s PC – server side cookies (called SMURFS) are used.

InfoNet and Web Orders have been made invulnerable to SQL injection attacks. This is done by looking at every selection field a user keys in, and removing all single quotes. This makes it impossible to, for example, search for BOB’S within a partner name; but it also makes it impossible for a malicious user to hijack the SQL statement that is constructed by the program based requests from the user.

← Older revision		Revision as of 16:16, 30 June 2016
Line 21:		Line 21:
	[[Category: Network Security]]		[[Category: Network Security]]
	[[Category: Web Orders]]		[[Category: Web Orders]]
		+	[[Category: WebSmart]]

← Older revision		Revision as of 23:38, 21 October 2015
Line 12:		Line 12:

	[[File:WebOrders-1.jpg]]		[[File:WebOrders-1.jpg]]
		+
		+	Some of these authorities are only available for shareholders and staff; not for customers.

@@ Line 19: / Line 19: @@
 Notice that in 'User details' there is a field for Pharmacist number.  When there are controlled narcotics on the order, a pharmacist number has to be included.  It can either be entered manually, or come from the user details.
-[[Category: Network Security]]
+[[Category: Network and System Security]]
 [[Category: Web Orders]]
 [[Category: WebSmart]]

← Older revision		Revision as of 23:48, 21 October 2015
Line 14:		Line 14:

	Some of these authorities are only available for shareholders and staff; not for customers.		Some of these authorities are only available for shareholders and staff; not for customers.
		+
		+	=Pharmacist Number=
		+
		+	Notice that in 'User details' there is a field for Pharmacist number. When there are controlled narcotics on the order, a pharmacist number has to be included. It can either be entered manually, or come from the user details.

← Older revision		Revision as of 23:17, 21 October 2015
Line 1:		Line 1:
		+	=Users=
		+
	Web Orders uses a file, as we don’t want to add all those users to the i. Because of the limited opportunity for the user to do anything bad, the security requirement is nowhere near that of InfoNet. An unauthorised user would be able to place an order, but they would not be able to change the delivery address.		Web Orders uses a file, as we don’t want to add all those users to the i. Because of the limited opportunity for the user to do anything bad, the security requirement is nowhere near that of InfoNet. An unauthorised user would be able to place an order, but they would not be able to change the delivery address.

Line 4:		Line 6:

	InfoNet and Web Orders have been made invulnerable to SQL injection attacks. This is done by looking at every selection field a user keys in, and removing all single quotes. This makes it impossible to, for example, search for BOB’S within a partner name; but it also makes it impossible for a malicious user to hijack the SQL statement that is constructed by the program based requests from the user.		InfoNet and Web Orders have been made invulnerable to SQL injection attacks. This is done by looking at every selection field a user keys in, and removing all single quotes. This makes it impossible to, for example, search for BOB’S within a partner name; but it also makes it impossible for a malicious user to hijack the SQL statement that is constructed by the program based requests from the user.
		+
		+	=User Authorities=
		+
		+	In the Web Orders user file (WSUSERP), are fields that control what functions the user can access. uniPHARM can maintain this through 'work with partners' in InfoNet, or an authorized person at the store can do it through WebOrders / Site Admin / Manage Users.
		+
		+	[[File:WebOrders-1.jpg]]