Question about send parameters from Drupal to an external site
Hi all, I am currently using an iFrame Page to create my content. I have an embeded iFrame which goes out to an external site and brings back some data to be displayed to the user. The data that is displayed depends on certain parameters and the only way I have thus far been able to get it to work is by passing them in the URL (i.e. http://localhost:8008/drupal/?param=value). I need to be able to hide these so they are not easily changed by the client. Posting through a FORM would be ideal. Is this possible? If not with this module is there another way I could be doing this? Thanks! -- web http://www.hyxspace.com aim hyx1138
Well, I guess you could pass the params through POST data, but that's really not any more secure for anyone who knows what to look for. In this case, I might build a module that can tap into your external data directly. You could include the necessary PHP as part of your page callbacks both for display and submitting your form data. -----Original Message----- From: support-bounces@drupal.org [mailto:support-bounces@drupal.org] On Behalf Of Robert Hicks Sent: Monday, April 26, 2010 9:37 AM To: support@drupal.org Subject: [support] Question about send parameters from Drupal to an external site Hi all, I am currently using an iFrame Page to create my content. I have an embeded iFrame which goes out to an external site and brings back some data to be displayed to the user. The data that is displayed depends on certain parameters and the only way I have thus far been able to get it to work is by passing them in the URL (i.e. http://localhost:8008/drupal/?param=value). I need to be able to hide these so they are not easily changed by the client. Posting through a FORM would be ideal. Is this possible? If not with this module is there another way I could be doing this? Thanks! -- web http://www.hyxspace.com aim hyx1138 -- [ Drupal support list | http://lists.drupal.org/ ]
Thanks Jeremy, I realize POST data is no more secure, but it makes it less obvious to the user that they can muck around with the request. I actually tried using POST data but the iFrame page failed to receive the request entirely, so at least off the shelf this module will only accept GET parameters. The framework idea is this: Drupal manages what a user can and can't see. This list of data that the user can see is then sent to an external page (which is actually a JSP running in a Tomcat Container) and the data is presented to the user. Basically Drupal is managing the requests to Apache Tomcat. Therefore, Tomcat knows nothing of user roles or even who is looking at the data. I realize this probably isn't the best way to do this but Java is my (and every other developer I work with) strongest language so we are trying to keep the existing functionality that we have already written in Tomcat as Servlets and JSPs. Hope that makes sense and thanks in advance! On Mon, Apr 26, 2010 at 9:57 AM, Gottwig, Jeremy M. (GSFC-272.0)[ZIMMERMAN & ASSOC.] <jeremy.m.gottwig@nasa.gov> wrote:
Well, I guess you could pass the params through POST data, but that's really not any more secure for anyone who knows what to look for.
In this case, I might build a module that can tap into your external data directly. You could include the necessary PHP as part of your page callbacks both for display and submitting your form data.
-----Original Message----- From: support-bounces@drupal.org [mailto:support-bounces@drupal.org] On Behalf Of Robert Hicks Sent: Monday, April 26, 2010 9:37 AM To: support@drupal.org Subject: [support] Question about send parameters from Drupal to an external site
Hi all, I am currently using an iFrame Page to create my content. I have an embeded iFrame which goes out to an external site and brings back some data to be displayed to the user. The data that is displayed depends on certain parameters and the only way I have thus far been able to get it to work is by passing them in the URL (i.e. http://localhost:8008/drupal/?param=value). I need to be able to hide these so they are not easily changed by the client. Posting through a FORM would be ideal. Is this possible? If not with this module is there another way I could be doing this?
Thanks!
-- web http://www.hyxspace.com aim hyx1138 -- [ Drupal support list | http://lists.drupal.org/ ] -- [ Drupal support list | http://lists.drupal.org/ ]
-- web http://www.hyxspace.com aim hyx1138
I'm often slow in working through workflows, so forgive me if you've already described all this using different language: In your original post, you mentioned something about posting through a form. For a workflow, does this mean that currently, you have a form (is this form in the iFrame as well?) which, upon submission, sends out a GET request to your Tomcat application, and then Drupal displays the resulting Tomcat page in an iFrame? -----Original Message----- From: support-bounces@drupal.org [mailto:support-bounces@drupal.org] On Behalf Of Robert Hicks Sent: Monday, April 26, 2010 12:27 PM To: support@drupal.org Subject: Re: [support] Question about send parameters from Drupal to an external site Thanks Jeremy, I realize POST data is no more secure, but it makes it less obvious to the user that they can muck around with the request. I actually tried using POST data but the iFrame page failed to receive the request entirely, so at least off the shelf this module will only accept GET parameters. The framework idea is this: Drupal manages what a user can and can't see. This list of data that the user can see is then sent to an external page (which is actually a JSP running in a Tomcat Container) and the data is presented to the user. Basically Drupal is managing the requests to Apache Tomcat. Therefore, Tomcat knows nothing of user roles or even who is looking at the data. I realize this probably isn't the best way to do this but Java is my (and every other developer I work with) strongest language so we are trying to keep the existing functionality that we have already written in Tomcat as Servlets and JSPs. Hope that makes sense and thanks in advance! On Mon, Apr 26, 2010 at 9:57 AM, Gottwig, Jeremy M. (GSFC-272.0)[ZIMMERMAN & ASSOC.] <jeremy.m.gottwig@nasa.gov> wrote:
Well, I guess you could pass the params through POST data, but that's really not any more secure for anyone who knows what to look for.
In this case, I might build a module that can tap into your external data directly. You could include the necessary PHP as part of your page callbacks both for display and submitting your form data.
-----Original Message----- From: support-bounces@drupal.org [mailto:support-bounces@drupal.org] On Behalf Of Robert Hicks Sent: Monday, April 26, 2010 9:37 AM To: support@drupal.org Subject: [support] Question about send parameters from Drupal to an external site
Hi all, I am currently using an iFrame Page to create my content. I have an embeded iFrame which goes out to an external site and brings back some data to be displayed to the user. The data that is displayed depends on certain parameters and the only way I have thus far been able to get it to work is by passing them in the URL (i.e. http://localhost:8008/drupal/?param=value). I need to be able to hide these so they are not easily changed by the client. Posting through a FORM would be ideal. Is this possible? If not with this module is there another way I could be doing this?
Thanks!
-- web http://www.hyxspace.com aim hyx1138 -- [ Drupal support list | http://lists.drupal.org/ ] -- [ Drupal support list | http://lists.drupal.org/ ]
-- web http://www.hyxspace.com aim hyx1138 -- [ Drupal support list | http://lists.drupal.org/ ]
Sorry for the ambiguity, I mentioned a FORM just a means to see if the iFrame could receive POST data, and this failed. The request never made it to the iFrame. Right now it works like this: User logs into the site which is managed by Drupal. Drupal retrieves all of the data said user is able to see/have access to. Drupal needs to send some identifier for each piece of data to our external site running in Tomcat (these will probably be primary keys in a table). This all works fine with the iFrame Page if I specify all of those identifiers in URL (like http://www.our-site/?a=1&b=2&c=3) but that is not desirable since I would like to hide the data being sent between the two servers. On Mon, Apr 26, 2010 at 1:00 PM, Gottwig, Jeremy M. (GSFC-272.0)[ZIMMERMAN & ASSOC.] <jeremy.m.gottwig@nasa.gov> wrote:
I'm often slow in working through workflows, so forgive me if you've already described all this using different language:
In your original post, you mentioned something about posting through a form. For a workflow, does this mean that currently, you have a form (is this form in the iFrame as well?) which, upon submission, sends out a GET request to your Tomcat application, and then Drupal displays the resulting Tomcat page in an iFrame?
-----Original Message----- From: support-bounces@drupal.org [mailto:support-bounces@drupal.org] On Behalf Of Robert Hicks Sent: Monday, April 26, 2010 12:27 PM To: support@drupal.org Subject: Re: [support] Question about send parameters from Drupal to an external site
Thanks Jeremy,
I realize POST data is no more secure, but it makes it less obvious to the user that they can muck around with the request. I actually tried using POST data but the iFrame page failed to receive the request entirely, so at least off the shelf this module will only accept GET parameters.
The framework idea is this: Drupal manages what a user can and can't see. This list of data that the user can see is then sent to an external page (which is actually a JSP running in a Tomcat Container) and the data is presented to the user. Basically Drupal is managing the requests to Apache Tomcat. Therefore, Tomcat knows nothing of user roles or even who is looking at the data. I realize this probably isn't the best way to do this but Java is my (and every other developer I work with) strongest language so we are trying to keep the existing functionality that we have already written in Tomcat as Servlets and JSPs.
Hope that makes sense and thanks in advance!
On Mon, Apr 26, 2010 at 9:57 AM, Gottwig, Jeremy M. (GSFC-272.0)[ZIMMERMAN & ASSOC.] <jeremy.m.gottwig@nasa.gov> wrote:
Well, I guess you could pass the params through POST data, but that's really not any more secure for anyone who knows what to look for.
In this case, I might build a module that can tap into your external data directly. You could include the necessary PHP as part of your page callbacks both for display and submitting your form data.
-----Original Message----- From: support-bounces@drupal.org [mailto:support-bounces@drupal.org] On Behalf Of Robert Hicks Sent: Monday, April 26, 2010 9:37 AM To: support@drupal.org Subject: [support] Question about send parameters from Drupal to an external site
Hi all, I am currently using an iFrame Page to create my content. I have an embeded iFrame which goes out to an external site and brings back some data to be displayed to the user. The data that is displayed depends on certain parameters and the only way I have thus far been able to get it to work is by passing them in the URL (i.e. http://localhost:8008/drupal/?param=value). I need to be able to hide these so they are not easily changed by the client. Posting through a FORM would be ideal. Is this possible? If not with this module is there another way I could be doing this?
Thanks!
-- web http://www.hyxspace.com aim hyx1138 -- [ Drupal support list | http://lists.drupal.org/ ] -- [ Drupal support list | http://lists.drupal.org/ ]
-- web http://www.hyxspace.com aim hyx1138 -- [ Drupal support list | http://lists.drupal.org/ ] -- [ Drupal support list | http://lists.drupal.org/ ]
-- web http://www.hyxspace.com aim hyx1138
If you are already talking about custom tables and such, why not use a web services approach? Rather than having the Iframe, have the php module use CURL to get the data. Then you can add something like AES keys or a private key exchange that would actually make the premissions model solid. You might check out services project for samples of this. Dave -----Original Message----- From: support-bounces@drupal.org [mailto:support-bounces@drupal.org] On Behalf Of Robert Hicks Sent: Monday, April 26, 2010 10:11 AM To: support@drupal.org Subject: Re: [support] Question about send parameters from Drupal to anexternal site Sorry for the ambiguity, I mentioned a FORM just a means to see if the iFrame could receive POST data, and this failed. The request never made it to the iFrame. Right now it works like this: User logs into the site which is managed by Drupal. Drupal retrieves all of the data said user is able to see/have access to. Drupal needs to send some identifier for each piece of data to our external site running in Tomcat (these will probably be primary keys in a table). This all works fine with the iFrame Page if I specify all of those identifiers in URL (like http://www.our-site/?a=1&b=2&c=3) but that is not desirable since I would like to hide the data being sent between the two servers. On Mon, Apr 26, 2010 at 1:00 PM, Gottwig, Jeremy M. (GSFC-272.0)[ZIMMERMAN & ASSOC.] <jeremy.m.gottwig@nasa.gov> wrote:
I'm often slow in working through workflows, so forgive me if you've already described all this using different language:
In your original post, you mentioned something about posting through a form. For a workflow, does this mean that currently, you have a form (is this form in the iFrame as well?) which, upon submission, sends out a GET request to your Tomcat application, and then Drupal displays the resulting Tomcat page in an iFrame?
-----Original Message----- From: support-bounces@drupal.org [mailto:support-bounces@drupal.org] On Behalf Of Robert Hicks Sent: Monday, April 26, 2010 12:27 PM To: support@drupal.org Subject: Re: [support] Question about send parameters from Drupal to an external site
Thanks Jeremy,
I realize POST data is no more secure, but it makes it less obvious to the user that they can muck around with the request. I actually tried using POST data but the iFrame page failed to receive the request entirely, so at least off the shelf this module will only accept GET parameters.
The framework idea is this: Drupal manages what a user can and can't see. This list of data that the user can see is then sent to an external page (which is actually a JSP running in a Tomcat Container) and the data is presented to the user. Basically Drupal is managing the requests to Apache Tomcat. Therefore, Tomcat knows nothing of user roles or even who is looking at the data. I realize this probably isn't the best way to do this but Java is my (and every other developer I work with) strongest language so we are trying to keep the existing functionality that we have already written in Tomcat as Servlets and JSPs.
Hope that makes sense and thanks in advance!
On Mon, Apr 26, 2010 at 9:57 AM, Gottwig, Jeremy M. (GSFC-272.0)[ZIMMERMAN & ASSOC.] <jeremy.m.gottwig@nasa.gov> wrote:
Well, I guess you could pass the params through POST data, but that's really not any more secure for anyone who knows what to look for.
In this case, I might build a module that can tap into your external data directly. You could include the necessary PHP as part of your page callbacks both for display and submitting your form data.
-----Original Message----- From: support-bounces@drupal.org [mailto:support-bounces@drupal.org] On Behalf Of Robert Hicks Sent: Monday, April 26, 2010 9:37 AM To: support@drupal.org Subject: [support] Question about send parameters from Drupal to an external site
Hi all, I am currently using an iFrame Page to create my content. I have an embeded iFrame which goes out to an external site and brings back some data to be displayed to the user. The data that is displayed depends on certain parameters and the only way I have thus far been able to get it to work is by passing them in the URL (i.e. http://localhost:8008/drupal/?param=value). I need to be able to hide these so they are not easily changed by the client. Posting through a FORM would be ideal. Is this possible? If not with this module is there another way I could be doing this?
Thanks!
-- web http://www.hyxspace.com aim hyx1138 -- [ Drupal support list | http://lists.drupal.org/ ] -- [ Drupal support list | http://lists.drupal.org/ ]
-- web http://www.hyxspace.com aim hyx1138 -- [ Drupal support list | http://lists.drupal.org/ ] -- [ Drupal support list | http://lists.drupal.org/ ]
-- web http://www.hyxspace.com aim hyx1138 -- [ Drupal support list | http://lists.drupal.org/ ]
participants (3)
-
Gottwig, Jeremy M. (GSFC-272.0)[ZIMMERMAN & ASSOC.] -
Metzler, David -
Robert Hicks