Security Considerations

What does a developer have to think about when developing Java-pages? Not much actually. It is important to think about the preDefine() function in the script code and the definition of dedicated users for the page.

Considerations

Normally when a user tries to access a page there will be a request regarding what NT-user the user is. This information will be mapped against a Foundation user which have specific access rights.

The config_user is used in preDefine() to fetch public configuration information in the database. The current user is used to fetch business data from the database.

First time someone ever asks for a specific URL the page will not exist in the page pool. Now the function preDefine() has to be called in the Java-script. The page will be placed in the page pool and have the same settings for all users executing it.

How does this affect the developers work? It's very important that the functionality in preDefine() is 100% user independent. All dedicated users should always get the same result when they call for a specific page. This means that the developer can only call for public defined configuration data - not business logic - in the preDefine() function.

Explanation of the Page Pool

Almost every objects created on an ASP page is placed in a pool. In reality this means that we have an instance of the ASPPage class, which always exists on a page. This class works as a container for other objects, such as blocks, fields, command bars, and tables. The instances have references to all the included components.

 Instances of ASP pages are placed in the pool. All objects which can be reused through the pool concept inherits from the abstract class ASPPoolElement.

The ASPPoolElement implements the changes between different states of the object.

An object gets the state 'Undefined' after been created.

When a page is defined (executed preDefined()), all  objects get "frozen" and status "Defined" and the page is placed in the pool.

A page that will be executed should be locked in the pool and activated. Some of the attributes in the specific objects may be changed.

All attributes in an object, which inherits ASPPoolElement, are divided into two groups: 'Immutable' - can only be changed during definition while the object's still is in the 'Undefined state'. 'Mutable' - can be changed later.

Changes of the 'Mutable' attribute will change the state of the specific object, including containers on all levels, to 'Dirty'.

When a page has finished executing it will be unlocked and get the 'Defined' state.

The pool is  a hash table, the URL is the key and the internal class Cluster as the value. Cluster points to a linked list with instances of ASPPage.

When a new instance of ASPManager (created at request) calls for an instance of ASPPage from the pool, for a given URL, the first free instance from a specific linked list is picked up. If all instances are already locked, a new one will be created by cloning an existing one. When the list is empty with no existing instances (first call) a new one must be created. To create a new one the function preDefine() must be executed inside the Java page.