Can't use decrypt_string function in calc field in grid, bug?

[[email protected]]

Hi,

I have a form that tries to use decrypt_string(Field,"pwd") in a calculated field in a grid and although that function is selectable via the function picker, *using it* causes an error and the grid will not save properly.

Has anyone encrypted/decrypted data on the fly in a grid, with success that would care to chime in?

With all the sites being hacked, I'd think we'd all be doing this....trying to encrypt sensitive data I mean, not failing I got that one down pat. ;)

Thanks in advance.

[[email protected]]

Re: Can't use decrypt_string function in calc field in grid, bug?

Hi,

I have a form that tries to use decrypt_string(Field,"pwd") in a calculated field in a grid and although that function is selectable via the function picker, *using it* causes an error and the grid will not save properly.

Has anyone encrypted/decrypted data on the fly in a grid, with success that would care to chime in?

With all the sites being hacked, I'd think we'd all be doing this....trying to encrypt sensitive data I mean, not failing I got that one down pat. ;)

Thanks in advance.

Bumps and hopes someone knows. I can't be the only one encrypting data.....

[Peter.Greulich]

Re: Can't use decrypt_string function in calc field in grid, bug?

Can't answer your question, but, as you may know, even if it works, unless you have an SSL cert. you will still be sending clear data back & forth across the web.

[Steve Wood]

Re: Can't use decrypt_string function in calc field in grid, bug?

What I've done in the past is to use MD5() function to encrypt the password so that the actual password is not in the database, the encrypted value is. But Peter's right, encryption here only protects if someone steals your hard disk of User logins, or somehow gets hold of the file.

The user still types in the regular clear text password in the Login screen, and that clear text password travels across the wires where someone could steal it. On the server side it does MD5(password) and compares the resulting encrypted value with the value in the database.

p.s if you are using the new V8 Security Framework, that encryption is taken care of for you, with more enhanced encryption that good old MD5().

Maybe explain what you are doing. Because if any user enters their password anywhere in a browser, even if you are encrypting it using xbasic, its still being transferred from the clent browser to the server prior to being encrypted.

SSL however makes every transation encrypted.

[[email protected]]

Re: Can't use decrypt_string function in calc field in grid, bug?

Can't answer your question, but, as you may know, even if it works, unless you have an SSL cert. you will still be sending clear data back & forth across the web.

I'm less concerned about a "man in the middle" issue then I am about the data being hacked at the server itself.

Thanks for responding though.

[[email protected]]

Re: Can't use decrypt_string function in calc field in grid, bug?

What I've done in the past is to use MD5() function to encrypt the password so that the actual password is not in the database, the encrypted value is. But Peter's right, encryption here only protects if someone steals your hard disk of User logins, or somehow gets hold of the file.

The user still types in the regular clear text password in the Login screen, and that clear text password travels across the wires where someone could steal it. On the server side it does MD5(password) and compares the resulting encrypted value with the value in the database.

p.s if you are using the new V8 Security Framework, that encryption is taken care of for you, with more enhanced encryption that good old MD5().

Maybe explain what you are doing. Because if any user enters their password anywhere in a browser, even if you are encrypting it using xbasic, its still being transferred from the clent browser to the server prior to being encrypted.

SSL however makes every transation encrypted.

Password issue aside, my original concern is the hacking of the server itself. Passwords being encrypted won't protect the data in any of the tables with perhaps the exception of the passwords themselves, and if they have the data, they don't need passwords.....

Thanks for responding...

But back to the original question...can you decrypt using the A5_decrypt function *in a grid*

/me waves to the fine folks at Alpha that would have to know *smile*

Alpha cares about security, they made the security framework.

This concept I'm discussing is even more important, I would think, since you could already do what the framework does now with some code (I know this because I do it).

Encrypting the data *where it resides on the web server* is a really desirable outcome and I'm hoping Alpha will let you decrypt on the fly in a grid....

/me crosses fingers

[Steve Wood]

Re: Can't use decrypt_string function in calc field in grid, bug?

Don't know how to use A5_decrypt in a grid, it would have to be in a calculated field.

But...

If you want to encrypt your data, just do the following:

• Open your app in A5
• Set a database password under security
• after its set, select Encrypt tables, select the tables you want to encrypt

that's pretty much it. Your data is encrypted, but both the desktop and the web side read/write the data just fine.

...you could already do what the framework does now with some code ...

Do explain because I tried pretty hard. How do you simulate Group Security with out the Framework? How do you avoid having to put code on each A5W page for security, without the Framework?

[[email protected]]

Re: Can't use decrypt_string function in calc field in grid, bug?

Don't know how to use A5_decrypt in a grid, it would have to be in a calculated field. <<<That's what I'm trying to do>>>

But...

If you want to encrypt your data, just do the following:

• Open your app in A5
• Set a database password under security
• after its set, select Encrypt tables, select the tables you want to encrypt

that's pretty much it. Your data is encrypted, but both the desktop and the web side read/write the data just fine. <<<So an encrypted table can be accessed just like a unencrypted table via WAS...I did not know that, that might let me achieve my goal in a different way but....>>>



Do explain because I tried pretty hard. How do you simulate Group Security with out the Framework? How do you avoid having to put code on each A5W page for security, without the Framework? <<< I never said I could do that without coding but I also am doing more than the framework provides>>>

The framework is neat and will probably work for a lot of people, my application requires a more granular (down to what fields can be seen not just if the page can be seen/read-write for example) approach. I've had to use a combination of an include file in conjunction with code on each page/event. No way around it for my situation.

I appreciate the feedback and will look at encrypting the tables in place. But just for sport....;)

/me returns to the original question that remains unanswered but is answerable I believe with every ounce of my being...

Can you use A5_decrypt in a calc field that would be used in a grid? I know you can use it in a WAS page in a dialog for a fact. If it can't be used in a grid, why not just say so?

/waves frantically as the simple question goes unanswered.....please don't make me burn an incident to get this answered, that would make me sad.

[Peter.Greulich]

Re: Can't use decrypt_string function in calc field in grid, bug?

Maybe this will give you some insight?

From the interactive editor:

t=table.open("clients")

t.fetch_first()

?decrypt_string(t.Client_Name,"pwd")
= ?;?rlNTfR]S@%%v)TrZt;NOcj28mqGA"Vf'OTT-xDD"j:!X9Dc

?decrypt_string(clients->Client_Name,"pwd")
ERROR: Field is not recognized

Notice that the 1st one works, but the other does not.

[Steve Wood]

Re: Can't use decrypt_string function in calc field in grid, bug?

The Security Framework IS field level. I don't know the answer to your primary question.

[[email protected]]

Re: Can't use decrypt_string function in calc field in grid, bug?

Maybe this will give you some insight?

From the interactive editor:

t=table.open("clients")

t.fetch_first()

?decrypt_string(t.Client_Name,"pwd")
= ?;?rlNTfR]S@%%v)TrZt;NOcj28mqGA"Vf'OTT-xDD"j:!X9Dc

?decrypt_string(clients->Client_Name,"pwd")
ERROR: Field is not recognized

Notice that the 1st one works, but the other does not.

I'm going to see if what you've suggested could work in a grid. I can already decrypt in code, it's making a calculated field work in a grid that seems to be elusive.

Thanks

[[email protected]]

Re: Can't use decrypt_string function in calc field in grid, bug?

The Security Framework IS field level. I don't know the answer to your primary question.

I was looking at the help file for information on the security framework and wonder if you can clarify the following if the framework is used:

For user A: field X on a grid is visible but read only
For user B: field X on a grid is visible and read/write
For user C: field X on a grid is not visible


I would think B and C but does the framework support A B & C ? Of course you can do it in code without the framework but is it really easier with the framework?

Also, I have a lot of levels to support the granularity my application requires, do you find the security framework helpful for complex rights assignments?

Thanks