Reference Guide
Dynamic Page Commands:
Unconditional, Time & Date, Counters, Security, Client Type
Contents
|
Version 3.1 Reference Guide |
Dynamic Page Commands:Unconditional, Time & Date, Counters, Security, Client Type |
Previous |
Next Contents |
Dynamic Page commands are used right in HTML pages that will be processed by NetCloak. There are three types of dynamic page commands. The first type inserts dynamic information from the server or the request, like the date or the value of a cookie, into the page in place of the command. The second type of commands let you hide or show portions of your document based on similar information. The third allows you to set the value of variables or NetCloak configuration settings. There are also a few that don't fit into these three categories.
All of the NetCloak commands are listed below, grouped according to the information they work with or what their function relates to on the server or in the page.
HIDE SHOW FLIPMODE
INSERT_TIME SHOW_TIME HIDE_TIME INSERT_DATE SHOW_DATE HIDE_DATE
INSERT_DAY SHOW_DAY HIDE_DAY
INSERT_COUNTDOWN
INSERT_COUNT SHOW_COUNT HIDE_COUNT
INSERT_COUNTERDATE INSERT_COUNTERTIME
INSERT_DOMAIN SHOW_DOMAIN HIDE_DOMAIN INSERT_USERNAME SHOW_USERNAME HIDE_USERNAME
INSERT_PASSWORD SHOW_PASSWORD HIDE_PASSWORD REQUEST_PASSWORD SET_USER
INSERT_CLIENT SHOW_CLIENT HIDE_CLIENT
INSERT_RANDOM SHOW_RANDOM HIDE_RANDOM INSERT_SAMERAND SHOW_SAMERAND HIDE_SAMERAND
INSERT_FILESIZE INSERT_MODIFIED
INSERT_HOST SHOW_HOST HIDE_HOST INSERT_HEADER SHOW_HEADER HIDE_HEADER
SET_HEADER INSERT_REFERRER SHOW_REFERRER HIDE_REFERRER INSERT_THISURL SHOW_THISURL HIDE_THISURL INSERT_PATH SHOW_PATH HIDE_PATH INSERT_SEARCH SHOW_SEARCH HIDE_SEARCH
INSERT_NETCLOAK SHOW_NETCLOAK HIDE_NETCLOAK SET_NETCLOAK NETCLOAK
INSERT_VARIABLE SHOW_VARIABLE HIDE_VARIABLE
INSERT_LOCAL SHOW_LOCAL HIDE_LOCAL
INSERT_GLOBAL SHOW_GLOBAL HIDE_GLOBAL
SET_VARIABLE SET_LOCAL SET_GLOBAL
VARIABLE_LIST
INSERT_COOKIE SHOW_COOKIE HIDE_COOKIE
SET_COOKIE
INSERT_BEEP REDIRECT REPEAT
EXEC_CGI EXEC_PIXO EXEC_FDML MACRO MODEMACRO
Specifying <HIDE> in your document will hide any text, links, etc. in your document until you specify otherwise. HIDE is unconditional; when you use HIDE, text following the command is hidden from all users, all of the time. This command is most often used to set up a conditional SHOW command, when you want to display a portion of a page only in certain circumstances.
Specifying <SHOW> makes all following HTML text viewable by all users, all the time.
For example, this cloaked document:
Here is my HTML text.
<HIDE>
This will never be seen by anyone.
<SHOW>
This is the end.
Is the exact same as this HTML:
Here is my HTML text.
This is the end.
The SHOW command is most often used to set up a conditional HIDE command, or to turn text display back on for all user after a HIDE command.
NetCloak's HIDE and SHOW commands make it possible to include notes or comments in your HTML documents that won't be revealed to users if they view or save the source of the document from their browser.
The FLIPMODE command, which accepts no parameters, simply changes the current mode from SHOW to HIDE, or vise-versa. It is handy when you want to display one of two possible sections of HTML with IF/THEN/ELSE logic. For example, if you have two HTML snippets, one for table-compliant browsers and one for others, you could:
<HIDE><SHOW_CLIENT !SupportsTables>
Table tags go here!
<FLIPMODE>
This is visible only to browsers that don't support tables:
<SHOW>
In this case, FLIPMODE doesn't save much, but it can be very handy when you have created a complex condition and simply want to turn on the faucet for everyone else.
INSERT_TIME will place the current time, as text, into your document. The time will be formatted using the time format set in the Date & Time control panel. The time will be inserted in either short or long form according to the current time format setting (See "Configuring NetCloak" in the User's Guide).
The offset and format parameters are both optional, but if both are specified, the offset must come first.
The offset parameter is a positive or negative number that specifies the fractional number of hours difference between the time set on the web server and the time that should be displayed. In other words, an offset of +2.5 will display the current time plus two and a half hours. An offset of -4 would display the time less four hours. This can be used to show times that vary between time zones.
For Example:
The time in Chicago is <INSERT_TIME>.
The time in California is <INSERT_TIME -2>.
The Time in New York is <INSERT_TIME +1>.
A plus (+) or minus (-) sign is always required when specifying an offset.
The format parameter allows you to override the current time format setting. Valid values for this parameter are either SHORT (for the short time format) or LONG (for the long time format).
Here is an example:
The current time is <INSERT_TIME LONG>.
In this case, the time will be inserted into the page, and will include seconds.
The HTML text that follows this command will be hidden during time intervals that meet the criteria of the specified comparison operator.
The comparison operator parameter is optional. If omitted, the default is to perform a begins with text comparison.
Hours are specified as on a 24-hour clock. For example:
<HIDE_TIME 21>
This will hide text following it for the one hour interval between 9:00:00 PM and 9:59:59 PM. Leading zeros for single digits are required, and multiple times may be specified.
If a text comparison operator is specified, the current time will be compared to the time parameters as a text value. For example, to hide text during the second half hour of every hour, you could write (assuming the short time format):
<HIDE_TIME CONTAINS ":3*" ":4*" ":5*">
If a numeric comparison operator is specified, the current time is compared to the time parameters as a number, by converting them each to the number of seconds since the beginning of time according to the MacOS. Therefore, you can hide text during certain hours of the day. For example, to hide text before noon, you can write:
<HIDE_TIME LT 12:00>
Any HTML text that follows this command will be visible to users during the specified times. The SHOW_TIME command is analogous to HIDE_TIME and its syntax is the same.
The INSERT_DATE command will place the current date, as text, into your document at the specified point.
The optional offset parameter allows you to display the date offset from the date and time set on the server. This is useful for displaying the date in another time zone. The offset must be preceded by a + for a forward offset or - for a backwards offset, and is specified in hours and tenths of hours. For example,
Today is <INSERT_DATE>
In 30 minutes it will be <INSERT_DATE +.5>
And yesterday was <INSERT_DATE -24>
The format of the date that NetCloak inserts will depend upon the date format you have selected in the Date & Time control panel, as well as the current date format setting. See the section Configuring NetCloak in the User's Guide for more information.
You can override the default date format setting by specifying either SHORT or LONG as the format parameter. The Date & Time control panel allows you to configure two date formats: a Long Date format and a Short Date format, and the format parameter allows you to select which should be used to display the date. The format may be specified without specifying an offset.
Here is an example:
The current date is <INSERT_DATE SHORT>.
Tomorrow will be <INSERT_DATE +24 SHORT>.
This will display the current date with the Short Date format specified in the Date & Time control panel. For the U.S. default date format, this will result in:
The current date is 10/31/97.
Tomorrow will be 11/1/97.
DayNum - Day of the month (1 - 31)
DayName - The day name (Sunday, Monday…)
WeekNum - The week number (1 - 53)
MonthNum - The month number (1 - 12)
MonthName - The month name (January, February…)
Year
These format parameters can be used with or without the optional offset parameter. For example:
Today is <INSERT_DATE DAYNAME>.
Tomorrow will be <INSERT_DATE +24 DAYNAME>
The commands above will insert the name of the day it is today in the first line and will be tomorrow in the second line.
The parameters which insert numbers will include a leading zero if NetCloak's global date format is set to LONG.
If trhe
HIDE_DATE allows you to hide portions of your page during the specified dates. SHOW_DATE allows you to show portions of your page during the specified dates.
When using numeric comparison operators or begin and end dates, the date parameters must be specified using the short date format configured in your system's Date & Time control panel. In the US, this format is usually set to mm/dd/yy. Partial dates, such as 1997, 11/98 or 04/15, and wildcards within date values, are not allowed. Leading zeros for single-digit months or days are optional, as are the century digits of the year.
If the first parameter following HIDE_DATE or SHOW_DATE in the tag is a comparison operator, then text is hidden/shown if the current date satisfies the comparison to any of the remaining date parameters.
For example, to hide text during all of 1997 and 1998 using comparison operators, you could write:
<HIDE>
<SHOW_DATE LT 1/1/97>
<SHOW_DATE GT= 1/1/99>
This will be hidden during 1997 and 1998.
<SHOW>
If the date formats on your server are configured to always include the century digits, you could also use:
<SHOW><HIDE_DATE CONTAINS "1997" "1998">
This will be hidden during 1997 and 1998.
<SHOW>
To display a message only a certain day of any year, you could use (assuming a U.S. short date format):
<HIDE><SHOW_DATE BEGINS "12/25">
Merry Christmas!
<SHOW>
If the first parameter is not a comparison operator, then the two parameters define a date range, and text will be hidden from the begin date until the end date. To work properly, the begin date must be before the end date. Only one begin and end date may be specified.
To suppress part of a page during 1998 this way, you could use:
<SHOW><HIDE_DATE 1/1/98 1/1/99>
This will be hidden during 1998.
<SHOW>
A single asterisk (*) can be used as the begin date to mean "any date earlier than". Using an asterisk for the end date means "any date after". An example is shown below, and another is included in the INSERT_COUNTDOWN section later.
NetCloak allows you to easily hide or show a section of a page on any single date, by simply omitting the end date parameter. In this case, NetCloak assumes an end date exactly 24 hours from the start date. For example:
<HIDE><SHOW_DATE 12/14/98>
Happy Birthday, John!
<SHOW>
NetCloak does take the time of day into account when the HIDE/SHOW_DATE command is used. You can include a specific time of day by following the date with an at sign ('@') and the time. For example,:
<SHOW><HIDE_DATE * 12/14/98@5:34>
Hidden until 12/14/98 at 5:34 a.m.
<SHOW>
It is important to note that when dates are specified without a time, the time is actually computed as midnight on the morning of the date specified. In other words, a date of 1/1/98 technically specifies the stroke of midnight on New Year's eve, the very beginning of 1998. So 1/1/98 and 12/31/97@24:00 refer to the exact same time.
Because of this, using the numeric equality operator '==' will make the comparison including the time, even though it is not explicitly specified. Using it will result in text being shown or hidden for one second at the specified date and time, so you typically do not want to use it with SHOW/HIDE_DATE commands. In other words, this:
<HIDE><SHOW_DATE == 12/25/98>
…is not equivalent to this:
<HIDE><SHOW_DATE 12/25/98>
The first shows text for one second at midnight; the second shows text for 24 hours.
The INSERT_DAY command will place the current day of the week, as text, into your document. NetCloak will insert the day in the format selected in the Date & Time control panel. Here is an example:
Today is <INSERT_DAY>.
For U.S. date format, this would appear in the page like this:
Today is Friday.
As in the INSERT_DATE and TIME commands, the offset parameter is an optional parameter that specifies a number of hours and tenths to offset the day. Note that the offset is not specified in days, because you may want to show the day in a different time zone. Only one offset may be specified.
HIDE_DAY hides the HTML text on the specified day(s). SHOW_DAY shows the HTML text following it on the specified day(s).
The comparison operator is optional. If omitted, a begins with comparison is used.
The days are specified as the first three characters of the day, and depend on the date format selected in the Date & Time control panel on the server. For U.S. format, the valid days are MON, TUE, WED, THU, FRI, SAT, SUN. As with most other commands, multiple days may be specified.
This example will hide text during the work week:
<HIDE_DAY MON TUE WED THU FRI>
Counting down to a specified day or time is handy when you have some event approaching that you would like to highlight. For example, you might want to count down the days until a big sale, or a mid-term exam, or the roll out of a new feature of your Web site. Using the command is simple, just include the command and specify the date (and optionally the time) you would like to countdown to. For example:
The new century starts in
<INSERT_COUNTDOWN_WDHM 01/01/2000>.
The INSERT_COUNTDOWN command has several variations, specified by the WDHM at the tail end of the command. The letters WDHM stand for Weeks, Days, Hours, and Minutes.
Any combination of these characters are allowed, and they give you control over exactly what is displayed. For example, to countdown the hours until Christmas of 1998, you would use:
Christmas '98 is in
<INSERT_COUNTDOWN_H 12/25/1998>.
You may also countdown to a specific time (with time expressed in military format), as in:
I'll have Thanksgiving dinner in <INSERT_COUNTDOWN_M 11/28/1998@16:00>
<P>
Too many minutes? How about <INSERT_COUNTDOWN_DM 11/28/98@16:00>?
Valid dates are between January 1st, 1904 and January 1st, 2030.
Also, the INSERT_COUNTDOWN command will also count up, if the date (and/or time) specified is in the past.
For example:
My son is <INSERT_COUNTDOWN_WD 5/6/93> old, and my daughter is <INSERT_COUNTDOWN_WD 12/2/94> old.
By default, NetCloak uses the labels Weeks, Days, Hours and Minutes when displaying the countdown. In the example above, the page would appear:
My son is 231 Weeks 5 Days old, and my daughter is 149 Weeks 4 Days old.
However, you can change the labels by specifying the label parameters. If you choose to include your own labels, you should specify all four, in order. In the example above, we can use lower case labels and include a comma after weeks by changing the command to:
My son is <INSERT_COUNTDOWN_WD 5/6/93 "weeks," "days" "hours" "minutes"> old, and my daughter is <INSERT_COUNTDOWN_WD 12/2/94 "weeks," "days" "hours" "minutes"> old.
Notice that even though hours and minutes won't be displayed, they are included for good form and consistency.
To avoid having the counter reverse itself and begin counting upward, you may want to use the SHOW_DATE and HIDE_DATE commands. For example:
<HIDE><SHOW_DATE LT 12/25/98>
Christmas is in
<INSERT_COUNTDOWN_WDH 12/25/98>.
<HIDE><SHOW_DATE 12/25/98>
Merry Christmas!
<HIDE><SHOW_DATE GT= 12/26/98>
Christmas is in
<INSERT_COUNTDOWN_WDH 12/25/99>.
<SHOW>
INSERT_COUNT will place an incremental number in the document. The number increases by one each time the command is executed.
The counter field allows you to specify a name for different counters. A name is not required, but is used so that you can maintain individual page counters. NetCloak will track the value of counters with different names separately. If no counter is specified, then a default counter is used. The counter name is not case sensitive.
Here is anexample:
Cloaked documents served: <INSERT_COUNT>
<P>
This page served: <INSERT_COUNT ThisPage>
You could include this example in any number of cloaked documents, changing the counter name ThisPage in each document. The first counter in this example (without the counter name) would be incremented each time any of these pages was accessed, whereas the second counter would be incremented for each individual page.
To display a counter without updating it, use the variation INSERT_COUNT#. For example:
This document served: <INSERT_COUNT MyPage>
<P>
That's <INSERT_COUNT# MyPage> times!
<P>
<INSERT_COUNT# MyPage> is quite a few times!
<P>
The Home Page has been accessed <INSERT_COUNT#> times.
This page would only increment the MyPage counter once, and would not increase the default counter (used, in this case, for the Home Page) at all.
You can also increment counters without displaying them by using the variation INSERT_COUNT*. This allows you to increment counters on each page of your server and then display them on a separate statistics page.
Counters may be preset to any value using the Counters tab of the Lists window. See the "Configuring NetCloak" section of the User's Guide for details. When you define a counter in the Lists window, you can also have the counter automatically reset itself at specified intervals.
NetCloak limits the number of individual counters to 512. See the section "Adjusting Internal Settings" for information on how this limit can be increased, if necessary.
In addition to displaying page counters, you can show and hide based on their values.
If the first parameter is a number, HIDE_COUNT checks the counter with the name specified by the counter parameter to see if it falls within the range defined by the lowval and highval parameters. If the counter name is omitted, the default counter is assumed. Here is an example:
This document served <INSERT_COUNT MyPage> times.
<HIDE_COUNT 0 50 MyPage>
<P>This line will be shown only after the page has been accessed 50 times.
<SHOW>
If the first parameter is not a number, it is treated as a counter name, and the text is hidden if the counter's current value satisfies the comparison with any of the given value parameters. If the comparison operator is omitted, the counter must exactly equal one of the given values. To test the value of the default counter, use either a pair of double-quotes, or use the name Default. Thus, the previous example could also be written as:
This document served <INSERT_COUNT MyPage> times.
<HIDE_COUNT MyPage LT 50>
<P>This line will be shown only after the page has been accessed 50 times.
<SHOW>
Note that the HIDE_COUNT command does not increment the counter, so you will normally need to use this command in conjunction with either INSERT_COUNT or INSERT_COUNT*.
This command is the SHOW version of the count commands. See HIDE_COUNT for details on how it works. The SHOW_COUNT command works exactly the same way, except that text becomes shown instead of hidden. For example, the following section would give a special note to the 100th person accessing your site:
<INSERT_COUNT* Winner>
<HIDE><SHOW_COUNT Winner == 100>
You are lucky visitor number 100!
<SHOW>
Counters are commonly reset occasionally, and NetCloak can do this for you at predefined intervals. To create a counter that periodically resets, see the "Configuring NetCloak" section in the User's Guide.
When a counter resets, you may want to display the date the counter started. The INSERT_COUNTERDATE command gives you an easy way to do this. For example:
There have been <INSERT_COUNT PageHits> visitors to this page since <INSERT_COUNTERDATE PageHits>.
When the counter PageHits is reset by NetCloak, the page will be automatically updated to display the date the counter was reset.
The optional offset parameter allows you to display the date offset from the current date and time. This is useful for displaying the date in another time zone. The offset must be preceded by a + for a forward offset or - for a backwards offset, and is specified in hours and tenths of hours. For example,
<INSERT_COUNTERDATE PageHits +3.5>
The optional format parameter is used to control how the date appears. If needed, use LONG for the Long Date specified in the Date & Time control panel, and SHORT for the Short Date format. The format may be specified without specifying an offset. For example,
<INSERT_COUNTERDATE PageHits SHORT>
If the specified counter does not exist, the text *Unknown Counter* is inserted into the page. If the specified counter exists, but has never been reset, the text *Never Reset* is inserted into the page.
See the INSERT_DATE command for more examples and sample dates in each format.
The INSERT_COUNTERTIME has the same purpose and functions in the same way as the INSERT_COUNTERDATE command above. Of course, instead of displaying the date a counter was last reset, this command displays the exact time. To expand on the example above:
There have been <INSERT_COUNT PageHits> visitors to this page since <INSERT_COUNTERTIME PageHits> on <INSERT_COUNTERDATE PageHits>.
Like the INSERT_TIME command, an offset can be specified as a number of hours difference between the system date of the server and the time to be displayed. The optional format parameter can also be used to tell NetCloak whether seconds should be displayed or not.
If the specified counter does not exist, the text *Unknown Counter* is inserted into the page. If the specified counter exists, but has never been reset, the text *Never Reset* is inserted into the page.
See the INSERT_TIME command for more details.
This command will place the user's address, as text, into your document. INSERT_DOMAIN may be a somewhat misleading name (it might better be called INSERT_ADDRESS), but is used to keep the naming consistent with the HIDE and SHOW commands where a sub-domain is normally specified as opposed to a complete address. Here is an example:
Your TCP/IP address is: <INSERT_DOMAIN>.
If you have turned on your web server's option to look up the DNS name associated with the client address for each connection, the INSERT_DOMAIN command will insert the DNS name found by the web server. Otherwise, it will insert the numeric IP address of the client.
Any HTML text that follows HIDE_DOMAIN will be hidden from those people in the domains that satisfy the comparison operator, until the next SHOW or HIDE command. Similarly, any HTML text that follows SHOW_DOMAIN will be shown to users in those domains. You can use the HIDE/SHOW_DOMAIN commands to tailor the content of your web pages to the people within your intranet or domain.
Multiple domains may be specified. For example, to hide text from sub-domains 123.456 and 123.89, use:
<HIDE_DOMAIN BEGINS 123.456 123.89>
Each domain must be separated by whitespace, and you may specify any number of domains (limited only by the maximum length of a NetCloak command - currently 4096 characters).
When the comparison operator is omitted from the command, NetCloak performs a begins with text comparison. This means that the address of the user accessing the page must begin with the given domain parameter for text to be hidden (or shown in the SHOW_DOMAIN command).
When performing text comparisons, you may specify as much or as little of the domain address as you like. For example:
<HIDE_DOMAIN 123.456.>
and
<HIDE_DOMAIN 123.>
would both hide text from the browser with the address of 123.456.78.9. The second command would also hide the text from a browser at the address 123.654.932.10, but the first would not. Specifying more of the address just makes the command more restrictive.
If you use a numeric comparison operator (==, LT, LT=, GT, GT=), you must specify the IP address parameters fully, because NetCloak converts the client address and each parameter to an integer value to perform the comparison. Using a numeric comparison operator allows you to check for IP addresses within a certain range which may be less than a full class C block of addresses. For example, to show some text only to clients in the address range 123.45.67.1 through 123.45.67.100, you would use:
<SHOW>
<HIDE_DOMAIN LT 123.45.67.1>
<HIDE_DOMAIN GT 123.45.67.100>
This text is only shown to clients within the specified IP address range.
<SHOW>
To use the HIDE/SHOW_DOMAIN commands with domain names instead of numeric IP addresses, you must turn on DNS lookups in your web server (in WebSTAR 2.x, check the Use DNS setting in the Misc. Settings dialog) then use one of the text comparison operators. For example, the command
<HIDE_DOMAIN ENDS .maxum.com>
would hide text from anyone coming from the domain maxum.com (as long as you have your web server set to resolve domain names).
Note: using a contains comparison can lead to unexpected results. For example, if you wanted to hide text from all clients in the .com domain you might use:
<HIDE_DOMAIN CONTAINS .com>
This would work as you would expect, but would also hide the text following it from a client in the domain home.common.edu or many.computers.se which may be undesirable. When using HIDE_DOMAIN this way, you should be as specific as possible. Usually, a begins with or ends with comparison operator is a better choice.
For backward compatibility with versions of NetCloak prior to 3.0, the syntax: HIDE_DOMAIN_C domain1 domain2 …> is still supported, operating identically to a HIDE_DOMAIN CONTAINS domain1 domain2 …> command. The new syntax is preferred.
This command will place the username specified for basic authentication into your document at the specified point. The example below inserts the user's name:
Hello <INSERT_USERNAME>!
The username inserted is whatever the user entered into an authentication dialog box displayed by their Web browser. Normally the user will not have entered a username or password unless they have loaded a page with a NetCloak REQUEST_PASSWORD command or protected by a realm or other security on your web server. Until the user enters a username and password, the username will be blank.
HIDE_USERNAME hides the HTML text that follows it from clients who have entered a username that satisfies the comparison to any one of the specified username parameters. SHOW_USERNAME shows the HTML text to clients whose username satisfies the comparison.
If the comparison operator is omitted, an exact text match (an is comparison) is required. However, letter case is ignored, so bob and BoB are considered an exact match.
As with other NetCloak commands, you may specify multiple usernames. For example, to hide text from everyone who has entered the username John or Bob, use:
<HIDE_USERNAME IS JOHN BOB>
To see if the user has entered a name, you can use the command with no parameters, or you can use the EXISTS comparison operator. This will hide/show text from anyone who has entered any username. The example below will display the username, or a message if the user has not entered one yet.
<HIDE><SHOW_USERNAME>
Hello <INSERT_USERNAME>!
<SHOW><HIDE_USERNAME>
You haven't entered a user name yet.
<SHOW>
This command will place the user's password, as text, into your document at the specified point. For example:
You entered the password <INSERT_PASSWORD>
This command should be used with caution, as it displays sensitive information on a page. Note that the actual password, not a series of bullets, asterisks, or blanks, will be displayed in plain text on the user's browser.
HIDE_PASSWORD hides the HTML text from users whose password satisfies the comparison with any one of the given passwords. SHOW_PASSWORD shows text to those same users.
If the comparison operator is omitted, an exact text match (an is comparison) is required. As always, capitalization is ignored.
As with the other NetCloak commands, you may specify a full or partial password, and you may specify any number of passwords in the command. For example, to hide text from all people with the password MOOF:
<HIDE_PASSWORD MOOF>
You can use the command without parameters, or with the EXISTS comparison operator, to see if the user has entered any password. The command HIDE_PASSWORD>, used by itself, will hide text from anyone who has entered any password. The following example will display the user's password if they have entered one, or a message if they haven't.
<HIDE><SHOW_PASSWORD>
Password confirmed as: <INSERT_PASSWORD>.
<SHOW><HIDE_PASSWORD>
You have not entered a password yet.
<SHOW>
This command allows you to request a password from the user for a page. If a valid username and password are not entered, NetCloak will return the No Access page instead of the requested page.
The prompt parameter used in this command is sent to the browser and will be displayed in the username/password dialog box presented to the user. The prompt text is typically displayed by the browser with a message like "Please enter a password for [prompt]."
In addition, you can specify the valid usernames and passwords right inside the REQUEST_PASSWORD command. To specify a user, enter the username and password within a pair of double-quotes, separated only by a comma (no spaces). For example, the username John with a password of Moof would be defined as John,Moof.
To allow John and a couple of other people access to a page, you might use a command like:
<REQUEST_PASSWORD "Name" "John,Moof" "Bob,Whopper" "Dawn,fbr192">
The REQUEST_PASSWORD command requires an exact match between the specified parameters and the username and password but ignores capitalization. The command:
<REQUEST_PASSWORD "my server" "lo,go">
would allow a username of Lo or LO but not Lonnie or Carlos, and would allow a password of Go or GO but not gone or fargo.
Note that the password request can be conditional when used in conjunction with HIDE and SHOW commands. Whenever text is hidden, the REQUEST_PASSWORD command will also be hidden and therefore not activated. In the example above, we could allow everyone access to the page on the weekend, but only allow John, Bob, and Dawn access during the week:
<HIDE_DAY BEGINS SAT SUN>
<REQUEST_PASSWORD "Weekday Access" "John,Moof" "Bob,Whopper" "Dawn,fbr192">
<SHOW>
On Saturday and Sunday, the REQUEST_PASSWORD command will be hidden, allowing everyone access to the page. During the week, a username and password will be required to gain access to the page.
Note that NetCloak's REQUEST_PASSWORD command is completely independent from your web server's built-in security or any security add-ons. In many cases, NetCloak is a simpler and more reliable way to secure a single page than realm-based or other security built into the web server. With the SHOW_USERNAME and SHOW_PASSWORD commands, NetCloak also allows you to apply password security to portions of an HTML page.
How it works: The REQUEST_PASSWORD command may seem somewhat like magic, but it is really quite simple. When NetCloak encounters a REQUEST_PASSWORD command in a page, it first checks to see if the incoming request from the user's web browser already includes a username and password that matches one of the username,password pairs in the command. If no match is found, the rest of the page is ignored. Instead of returning the page, NetCloak sends an Authorization Required response to the browser, which includes a special HTTP response header along with the contents of the configured No Access page. When this special response is received by the browser, it recognizes it as a request to display the username/password dialog box to the user, and does so. If the user then enters a valid username and password into the dialog box, the same page containing the REQUEST_PASSWORD command is simply re-requested by the browser, but this time it includes the required username and password in the request, so NetCloak displays the page. The browser will then send the username and password in every subsequent request until the browser is quit by the user. When the user cancels the username/password dialog box, the browser simply displays the contents of the No Access page it has already received from NetCloak.
The SET_USER command is used to add a user account to a named list of known users stored by NetCloak internally, and is used in conjunction with the REQUEST_PASSWORD command to require a password to access a particular page. A REQUEST_PASSWORD command can contain the name of a list instead the actual list of valid usernames and passwords, and the SET_USER command is used to add and remove users from the list. The named lists are commonly referred to as "realms", but NetCloak's username and password lists have no connection to security built into your web server.
For example, assume there is a page on your server called secret.html, which needs to be password protected. The page can be protected with the command:
<REQUEST_PASSWORD "Secret">
This command will cause the web browser to open an authentication dialog asking the user to enter a username and password. Valid username and password pairs can then be created using the SET_USER command, like this:
<SET_USER "Secret" "Bob" "Moof">
It is important to note that the SET_USER command is persistent, much like global variables. In other words, when you issue the command shown above, the user Bob will be able to access the secret.html page using the username Bob and the password Moof days, months, or even years later. Once a username and password are set with the SET_USER command, the user account is maintained until deleted (see below for details on deleting user accounts).
The SET_USER command is most often used on a page that is accessed based on a form submission. This allows you to create an input form that will create user accounts granting access to password protected pages. Any of the parameters in the SET_USER command can be variables, in which case the variable value will be used as parameter text. For example, you might create the following input form:
<FORM ACTION="reguser.nclk" METHOD=POST>
Username: <INPUT TYPE=text Name="username">
<P>
Password: <INPUT TYPE=text Name="password">
<P>
<INPUT TYPE="submit" VALUE="Update">
</FORM>
This form accepts two input fields: username and password. The reguser.nclk page might then look like this:
<SET_USER "Secret" username password>
You have been registered!
Whenever you need to provide a new user with access to the secret.html page that includes the REQUEST_PASSWORD command shown above, you can simply open the registration form in a Web browser, enter the username and password, and submit the form. From then on, that user will have full access to the protected page.
User accounts can be removed by specifying the keyword DELETE_USER as the password. For example, to delete the user Bob that was set above, use the command:
<SET_USER "Secret" "Bob" DELETE_USER>
The user account will then be permanently removed from the realm.
NetCloak stores the user accounts in a plain text file in the NetCloak Files folder. The file for each realm is named with the name of the realm followed by .reg, and can be opened with any text editor, database, or spreadsheet application. If you need to automate user account management, quit the server (or NetCloak, if you are using the CGI version), make the needed changes to the .reg file, save it, and restart NetCloak.
This command will place the name of the user's Web browser, as text, into your document at the specified point. The browser name is defined by the browser itself.
Here is an example:
Your Web browser is <INSERT_CLIENT>.
HIDE_CLIENT hides the HTML text from clients using any Web browser that satisfies the comparison operator. SHOW_CLIENT shows text to those clients.
These commands are most commonly used to tailor elements of a page to match the features of particular browsers. They actually work on the identification string that the browser sends with each request, which may not exactly match the browser's name. The two most popular browsers, Netscape Navigator and Internet Explorer, each have some peculiarities.
Web crawlers or "spiders" from search engines such as Excite or HotBot also identify themselves the same way that browsers do. The identification string frequently also includes the version number and platform of the browser or spider. This information creates additional uses for HIDE_CLIENT, allowing you to provide special content to Web robots that will control which links on your site are crawled or optimize their index of your pages.
The comparison operator is optional. If omitted, NetCloak performs a contains comparison, which means that any browser whose identification string contains any of the text parameters will satisfy the command.
Navigator identifies itself as Mozilla, not Navigator or Netscape. This is further complicated by the fact that most versions of Internet Explorer also identify themselves as Mozilla, followed by "compatible" and "MSIE". Differentiating the two is no problem with NetCloak, but requires a bit of extra work. Here are the identifications of some common browsers:
Mozilla/2.0 (compatible;MSIE 2.1;Mac_PowerPC)
Mozilla/2.0 (compatible;MSIE 3.0;Mac_PowerPC)
Mozilla/3.0 (compatible;MSIE 4.0;Mac_PowerPC)
Mozilla/2.0 (Macintosh; I; PPC)
Mozilla/3.0 (Macintosh; I; PPC)
Mozilla/4.03 (Macintosh; U; PPC)
To distinguish Navigator and Explorer (not to mention other Netscape "compatible" browsers), simply add an extra HIDE or SHOW to check for the word compatible, as in:
You are using
<HIDE>
<SHOW_CLIENT Mozilla>
<HIDE_CLIENT compatible>Netscape Navigator
<HIDE><SHOW_CLIENT MSIE>Internet Explorer
<SHOW>
When using a contains text comparison, there is no need to specify the entire browser name. It is best to specify enough of the browser name to uniquely identify it without specifying so much that different versions of the same browser are treated differently (unless that is the desired effect). For example, to hide a portion of your HTML document from Navigator clients, you would probably just use:
<HIDE_CLIENT CONTAINS Mozilla>
To specify a particular version, you could use something similar to:
<HIDE_CLIENT CONTAINS Mozilla/2>
Since the name specified in the command can appear anywhere in the identification, you can use it to match other information in the string. For example, the Macintosh version of most browsers include Mac in their name, so you can use the HIDE_CLIENT command to customize your pages for Macintosh clients. To hide text from Macintosh browsers, you can simply use:
<HIDE_CLIENT CONTAINS Mac>.
Unfortunately, it is impossible to give a complete list of Web browser identifications, since new client applications and new versions of existing ones are certainly going to become available. The best way to find out the identification for a particular browser is to set up a cloaked page with an INSERT_CLIENT command, and then access it from the browser in question. The page will then show you exactly what the browser gives as its name. You can also look at your web server log file to see the identification string for Web browsers used by people visiting your Web site.
| Copyright © 1996-2000 Maxum Development Corporation http://www.maxum.com/ |
Previous |
Next Contents |