#CSP

Is there any mechanism already implemented in IRIS to prevent XSS exploits ?

This case happen when user input html/javascript content into fields and submit the page. If saved content is rendered as is, it's going to be executed by anyone visiting the page.

What I am looking for :

Getting proctect error on csp custom login page.

It says to add role to CSPSYSTEM i have given role to db (rw i would like to change to R once working). It has not solved issue

Hello,

First of all thanks for your time reading this doubt.

We have discovered the following behaviour. Inside a Router we have a roule which needs to filter out the ADT_A08 messages which have not OBXs.

The legacy system had this rule implemented:

(((Document.{OBX(1).SetIDOBX}<"1")||((Document.{EVN:EventReasonCode}!="COD")&&(Document.{EVN:EventReasonCode}!="FIN")))

However we have tested it and it does not filter out the ADT_A08 messages.

Dear Folks,

I have recently studied deepsee and developed few dashboards needed for our web app users. I am trying to embed them in our existing web app which uses angular with delegated user access. I need to embed the native IRIS dashboard into it. ( I can't use Highcharts or any other js tools).

How do I setup the dashboards to work with delegated authentication (Without providing access to management portal or other parts) ? Also should I use the default csp/{Namespace}/_DeepSee.UserPortal.DashboardViewer.zen? or any other web application URL ?

Thanks

We have a CSP pages script, which gets and sets a cookie for email tracking purposes, we had problems with cookies not being passed to this script when the URL was opened from an email client due to being cross-site, so I set Session Cookie Scope & User Cookie Scope to None instead of Strict.

This solved the issue with cookies not being passed, however the script entirely does not work anymore due to the error:

"Invalid CSP response cookie. SameSite cannot be set to None without Secure. : CSP Error"

Is there any way to include a CSP page within a CLS?
Example: #Include file.csp

Context: I work with a legacy that most screens are built using only CLS. I'm trying to change this by separating the frontend layers to be built only with CSP and backend layers using CLS. I improvised a method that injects an iframe to render the CSP in CLS through that iframe, but I'm still not happy. I need to know if there is any way to include this CSP using some specific resource for this.

Good morning,

First of all thanks for reading this question.

We have been asked by a client to check if our Soap Service has charset / encoding "UTF-8".

We have been investigating the class "EnsLib.SOAP.InboundAdapter".

A bit of an old school CSP question. <csp:search> is a really nice, quick way to make easy lookups for CSP pages, especially for back office stuff that doesn't need to look pretty for the modern web app user.

At any rate, I'm here at the moment:

Hey everyone, I am implementing version control with git-source-control on our codebase and I ran into a pretty strange issue. I believe I have the set up (mostly) correct as the behavior with .cls files is exactly as expected. However, I noticed that git is not keeping track of any changes to CSP files.

Specifically, if a new CSP file is created and saved, I will get the following output:

exporting new version of /csp/testdb/wrc.csp to C:\InterSystems\IRIS\mgr\repo\TESTDB\csp\testdb\wrc.csp

I'm currently fighting with SoapUI to get the HS WSDLs imported.

My first issue is, the IRISUsername and IRISPassword parameters don't seem to work.

i've tried the following url:

https://ifwap0661.ad.klinik.xxxyyy.de/ucrdev/csp/healthshare/hsrepositor...

Does anyone know how to get the closing tab/menu changing event in a CSP? I've tried the JS "OnBeforeUnload" already but it seems the browsers aren't allowing it anymore. I need to show a pop-up that holds the user if trying to get away before completing the stage.

Hey, So the title pretty much describes the question:
Where and How can i see the Stream that contains the response back to the client of a CSP application.

When the request is being processed and finished we return a response to the client - We do that by writing the data to a stream and that stream is sent back to the client.
I wanted to know how i can access the point right before that Data is actually written to the client back (meaning the place where the response is actually being send back, the last point of contact).

Hello,
Please, we would need your help 🙂:

In a development environment, we have added quite a few presentation contexts to the DICOM configurations (the associations). We would need to find a way to export them from this environment to make it easier for us to import them in PRO (and avoid doing it by hand one by one).

Hi developers!

While developing web apps the security practice I consider safe and convenient is to create a special Role (e.g. equal application name) which contains security resources which application will need (SQL tables, priviledges, database access, etc) and assign it to the Web Application.
So the user gets this role once it loggs in to the application (via password, no password or delegated).

Convenient, right?

So, the question is, when I deploy the app as an IPM module what should I put as a database access?