Information Systems:Web Orders Security

Users

Web Orders uses a file, as we don’t want to add all those users to the i. Because of the limited opportunity for the user to do anything bad, the security requirement is nowhere near that of InfoNet. An unauthorised user would be able to place an order, but they would not be able to change the delivery address.

None of the programs are storing cookies on the user’s PC – server side cookies (called SMURFS) are used.

InfoNet and Web Orders have been made invulnerable to SQL injection attacks. This is done by looking at every selection field a user keys in, and removing all single quotes. This makes it impossible to, for example, search for BOB’S within a partner name; but it also makes it impossible for a malicious user to hijack the SQL statement that is constructed by the program based requests from the user.

User Authorities

In the Web Orders user file (WSUSERP), are fields that control what functions the user can access. uniPHARM can maintain this through 'work with partners' in InfoNet, or an authorized person at the store can do it through WebOrders / Site Admin / Manage Users.

Some of these authorities are only available for shareholders and staff; not for customers.

Pharmacist Number

Notice that in 'User details' there is a field for Pharmacist number. When there are controlled narcotics on the order, a pharmacist number has to be included. It can either be entered manually, or come from the user details.