I have recently been asked if OpenInsight 10 can be enhanced to enable developers to filter TCL commands, or in other words, to only show TCL commands that the developer wishes to expose to their end users. For example, it is often a requirement or wish, for DELETE to be removed or screened from the users because it can cause issues. However, it would be useful if LIST could be exposed so that knowledgeable end users could run list commands for quickly produced ad-hoc reports.
During one of my catch-up sessions with Mike, I put this to him and found that this is actually something that was introduced back in 2009. Most likely following a customer request at tone the RUG meetings that Mike holds from time to time.
As Mike has detailed for me, configuring the system to filter TCL commands it pretty straight forward:
- As an OpenInsight developer, you initially need to make a record in the SYSENV file. This record should have a key with one of the options noted below:
- In this record, you should enter a command that you want your users to have access to and be able to use from TCL (as shown below). The user will then be limited to using only those those commands by typing the commands into the TCL as normal. The TCL Assistant will also then only show those commands that are available to the users.
Now, with the options set as above, when the TCL Assistant button is pressed the user will be given a filtered list of available commands (as shown below).
If the user tries to be clever and force a command that has been filtered out of the available options (for example, DELETE or COPY_ROW), OpenInsight will return a ‘command not supported’ message and the command will not run.
This now enables developers to safely expose TCL with the controls that ensure that their systems are safe and that end users cannot run a command that is not unsupported by the developer in their application.
I no longer maintain an OpenInsight version 9 system on my machine for testing this (I’m fully OI10) and although the screen shots within this posting are taken from an OpenInsight 10 system, the above should be possible in most of the OpenInsight 9.x versions released since 2009.
Finally, thank you to Mike for helping me to put this blog posting together.