Is there a way to limit access to the source code of a cdml file? For example, if I have a URL that is something like: http://207.111.111.111:8080/FMPRO?-db=sample.fp5&lay=1&format=/test/search.html&-findall, what is to stop someone from typing in http://207.111.111.111:8080/test/search.html to see the underlying source? I tried this on the Filemaker knowledgebase and they somehow limit access.

I just tried it, and they do not limit access. Try this link...

http://192.35.50.21/tiaus/results.html

... it shows all of the CDML codes for their results page.

I don't think there is any way to prevent people from viewing the pages directly. Maybe somebody will come up with a Java applet or something, but I cannot think of a way to do it.

Perhaps it could be made more difficult by using lots of includes, but that would be a pain for the developer as well to work with.

If you can't limit the ability to see the source, how can you limit a user's ability to do certain things using a login system, since the login system will pass some token which the source will interpret? For example, I want an administrator to see one thing on an orders.html page, but a data entry person to see something different. Do I have to create separate orders.html files for each access level?

It is possible to limit the access by using two (physical) server. The first server is the web-server with the FM-web-server-connector installed to manage the access to FM databases. The second server is a dedicated FM-server with a firewall. In the firewall configuration only the IP-address of the web-server is allowed to access the FM-server and so no one else can download the html-files with the CDML-syntax, that are locaded in the web-folder on the FM-server of course. (It is not possible to use the build-in option of the web-companion instead of a firewall-application.)

Greetings, Michael

------------------

Michael Adams

Germany

quote:

---

Originally posted by shimoda:

Is there a way to limit access to the source code of a cdml file...

---

If you will use frames and on each page force frame script, the HTML code is more secure.

What is meant by force frame script? How do you do this?