How to manage files in the storage area

Introduction

For safety reasons, the manipulation of files between the client and the server has to apply the following rules:

When a user executes an operation which generates a file on the client, the user has to manually choose the destination of the file.
When a user executes an operation which requires a file stored on the client, the user cannot choose the destination of the file on the server.
When a user executes an operation which generates a file on the server, the user does not have rights to browse the server's file system to set the destination of the file.
When a user executes an operation which requires a file stored on the server, the user does not have rights to browse the server's file system to choose the file to use.

This article is intended to describe how Sage X3 features have to evolve in order to abide by these security rules. It is intended to manage file storage with version 6 style code in Classic mode.

How to configure a X3 storage area

A Sage X3 storage area is a limited area of the server's file system that manages users' files.

A storage area is created by an administrator using the volumes management function:

The physical path of a storage area is computed by the server by calling the filpath function with the ROOT parameter set by the administrator.
Users should not be able to see the physical path of a storage area. They will be displayed as logical paths whose syntax is [volume]/file.

Example: If the root property of the TMP storage area of MYFOLDER is set to tmp, and the installation path of the folder is c:\sage\$$prod\mysolutionX3\MYFOLDER:

A volume defined by the ROOT parameter equal to 'tmp' will correspond to a storage path equal to c:\sage\$$prod\mysolutionX3\MYFOLDER\tmp on a Windows server.
If a "file.tmp" file is created in this storage area, the file will appear with the following path: [tmp]/file.tmp and will be stored with the following path: c:\sage\$$prod\mysolutionX3\MYFOLDER\tmp\file.tmp.

How to select a file on the server (Classic)

A dedicated DSYRFICREP window is implemented to select a file in a storage area.
This dialog is displayed on the 'select' event of the 'ASTO' type which is created to manage storage area files.

Users can select a file by using the 'DSYRFICREP' window or by entering paths.

In both cases, the logical path can be controlled by using the 'CTL_VOLFIL' function implemented in the script 'ASYRSTO'.

The 'CTL_VOLFIL' function returns a code which can be used for setting the 'mkstat' variable. It receives the following parameters:

Parameter	Description	Expected values
CLISRV (in)	type of file	1 : client. 2 : server.
PATH (in)	file's logical path	syntax = [volume]/file.
FULLPATH (out)	file's physical path.	-
TYPE (in)	type of operation	E_TYPE_FILEREAD : controls that the file exists. E_TYPE_FILEWRITE : controls that the file can be created. E_TYPE_FOLDER : controls that the folder exists.
MESSAGE (out)	error message	error message set if the function returns a value greater than 0.

TIP:
A simple way to adapt a mask for using the storage area is to :
* Hide the 'FIC' field
* Add a corresponding 'ASTO' field
* Use the 'CTL_VOLFIL' function to control the contents of the 'ASTO' field and setting the physical path in the 'FIC' field.
Example: screen PATCH

Example (see PATCH.src)

#set the 'enum' values (E_TYPE_FILEREAD...)
Gosub ENUM_VOLFIL_TYPE  From ASYRSTO
#control the logical path set in VALEUR and set the physical path in [M]FICHIER
mkstat = func ASYRSTO.CTL_VOLFIL([M]TYPEXP,VALEUR,[M]FICHIER,E_TYPE_FILEREAD,GMESSAGE)

How to download a file on the client

Download operations are automatically managed by the 'ORDSYS COPCLI' function.
Because the user cannot select the destination of the download, the 'ASTO' field has to be grayed out.

How to upload a file from the client

Upload operations are automatically managed by the 'ORDSYS COPSRV' function.
Because users cannot select the destination, files are uploaded in the 'TMP' storage area where they are stored as temporary files.
As a consequence, the behavior of the second parameter was changed to return the physical path of the file uploaded on the server.
Scripts may have to be slightly changed to prevent users from seeing the physical path.
Because the user cannot enter the origin of the field to upload, the 'ASTO' field has to be grayed out.

Index Home