SRS Param

Optional XML element with command parameters xpath = srs/def/itm[@model='param']

Attributes

Required:

• name

Optional:

• label - name
• title - placeholder
• scope - command - parameter will be applied only to matching command (comma separated values available)
• value
  • null - equals null
• lg - hide/show on desktop
• sm - hide/show on mobile
• type - default text
  • select - dropdown type, !Always executed
  • decimal: number, integer, money, decimal
  • numeric: int, bigint, tinyint, smallint, integer
  • uniqueidentifier: uniqueidentifier
  • date: date, datetime, datetime2, smalldatetime, time
  • float: float
  • other: text, number, password, hidden, color, date, checkbox - https://www.w3schools.com/tags/att_input_type.asp
• opts
  • server - server side parameter useful for predefined values cannot be overwritten by user
  • json-body - entire body request as parameter
  • json-xml-root - convert json to xml (root element created)
  • json-xml - convert json to xml (root element not created)
  • req - parameter required

Notes

Using proper data type is important for proper data validation

Parameters

Processing order:

1. Server side parameters (cannot be overwritten by user)
2. Query String
3. Body Parameters

• SQL injections Using parameters is safe and recommended. To better understand what is SQL injection and why we do not allow processing commands read https://owasp.org/www-community/attacks/SQL_Injection

 <itm model="param" name="username" opts="server">[[kv.v.user.username]]</itm>

Server Side Variables

There are few predefined variables available.

• [[kv.v. .....]] all variables in kv.v. scope
• [[kv.v.owner.name]] Owner Name, also in footer
• [[kv.v.owner.contact]] Owner contact, also in footer
• [[kv.v.owner.footer]] Footer additional text
• [[kv.v.owner.language]] Default language
• [[kv.v.user.username]] - username
• [[kv.v.user.userid]] user id
• [[kv.v.user.currency]] currency
• [[kv.v.user.teamid]] teamid
• [[kv.v.user.app_name]] user current applicaiton name
• [[kv.v.api.version]] version
• [[app_name]]
• [[apimethod]] - GET/POST
• [[apipath]] - example {{host}}/api/srs/xtet?param=param
• [[userpermission]] csv list
• [[basepath]] - example http://test.com
• [[srs_name]] - srs_name
• [[session_id]] - Sql Server UUID, database friendly

Examples type="select"

<srs title="Select Example">
  <def>
    <itm model="param" name="leadUserID" type="select"></itm>
    <itm model="command" name="view" label="Firmy">
      <![CDATA[
    SELECT  
        f.firmNR, 
        vat_status,
        f.taxcode,
        f.firmname name, 
        f.firmNameShort, 
        f.firmTypeID, 
        f.leadUserID, 

        f.www, 
        f.groupID, 
        UPPER(f.countryCode) countryCode,   
        f.city, 
         f.streetName + ' ' + isnull(f.houseNumber,'') + ' ' + isnull(f.flatNumber,'')  streetName,
        f.postCode,

        f.countryState,
        f.phoneNumber, 
        f.email, 
        f.account, 
        f.accountInsurance,
        f.classifications, 
        f.discountCategoryID, 
        f.discountValue,
        f.modDate, 
        f.modUsername,
        f.firmid,latitude,longitude ,
        vat_date
    FROM firm.firm f left join vat on f.taxcode =vat.vat_nip
    WHERE status >-1
        and (@firmTypeID IS NULL OR f.firmTypeID = @firmTypeID)
        AND (@leadUserID  IS NULL OR f.leaduserid = @leadUserID)
        and (@COUNTRYCODE IS NULL OR f.countrycode = @COUNTRYCODE)
        and (@firmname IS NULL OR f.firmname like @firmname)
        AND (@discountCategoryID IS NULL OR f.discountCategoryID = @discountCategoryID)
        AND (@city IS NULL OR f.city  like @city)
    ORDER BY moddate desc 

    ]]>
    </itm>
    <itm model="command" name="leadUserID" type="uihidden"> 
        select userID,username from [user].[user]
    </itm>
  </def>
</srs>

Example type="checkbox"

<itm model="param" name="critical" type="checkbox">true</itm>
<itm model="param" name="Warning" type="checkbox">false</itm>
<itm model="param" name="Informational" type="checkbox">false</itm> 

Dynamic default value

<srs>
  <def>
    <itm model="param" name="BillingAddress"></itm>
    <itm model="param" name="BillingCountry"></itm>
    <itm model="param" name="date_from" type="date">[[datefrom]]</itm>
    <itm model="param" name="date_to" type="date">[[dateto]]</itm>
    <!-- Important command.name must be parameters -->
    <itm model="command" name="srssetup" type="server">
select 
  convert(varchar,DATEADD(month, DATEDIFF(month, 180, getdate()), 0),23) datefrom,
  convert(varchar, EOMONTH(getdate()), 23) dateto
    </itm>
    <itm>
SELECT
  [InvoiceDate],
  [BillingAddress],
  [BillingCity],
  [BillingState],
  [BillingCountry],
  [BillingPostalCode],
  [Total]
FROM [dbo].[Invoice]
where (
    @BillingAddress is null
    or BillingAddress like @BillingAddress
  )
    </itm>
  </def>
</srs>