The Files

• The Startfile must contain a Server Side Include (SSI) statement which calls WebKeystone and includes the results in HTML.

  ... <!--#include virtual="/wkstone/webkeystone.py?UserID=biz_webkeystone&Profile=examples/example4.prof" --> ...

  SSI include statments look very much like comments, but they get interpreted and acted upon by your web server. This URL points to "/wkstone/webkeystone.py" and passes two fields to it: UserID and Profile.

  Oftentimes you must name your webpage with a ".shtml" extension in order for SSI statements to work. This is the default behavior with Apache (the most popular web server software). Your web site administrator may also need to turn SSI on for your website in order for this to work. Note that this Startfile is named "example4.shtml".

• The Profile: the profile is fairly simple. It selects a banner from a list, then returns the HTML to the website.

  # File : example4.prof # Funciton : Example showing how to build rotating banners using WebKeystone. # # Define your list of URLs in the following format. # # (<website address>, <image address>) # adlist = [ + ('http://www.webkeystone.com/', 'http://www.webkeystone.com/wkimages/logoSmall.gif'), + ('http://www.python.org/', 'http://www.python.org/pics/pythonHi.gif'), + ('http://www.apache.org/', 'http://www.apache.org/foundation/images/asf_logo.gif'), + ] # # Select which advertisement # selection = f.random.choice(adlist) website = selection[0] image = selection[1] # # Create HTML for banner using substitution. # %banner = <a href="%(website)s"><img border="0" src="%(image)s"></a> RETURN RAW banner

  selection = f.random.choice(adlist)

  The f.random.choice function takes a list as an argument and randomly chooses one item from the list. This uses the "random" library available from the "f" (functions) module.

  RETURN RAW banner

  Rather than returning an Endfile in the usual manner, here we simply return a string to the calling page. The RAW keyword directs WebKeystone to return the string contained in the variable "banner".

Security Considerations

Some webserver administrators may be reluctant to enable SSI for customer pages because of security concerns. It is often believed that enabling SSI will allow customers to execute any command on the system. This is one of many reasons WebKeystone was developed, so we would not advocate exposing your system in this way.

There is a way of configuring Apache web servers to support SSI without compromising security. This example configuration illustrates how to enable SSI while still providing security:

<Directory /home/joeblogg/html> 
Options IncludesNoExec 
</Directory>

The "IncludesNoExec" statement will allow SSI but not allow any commands to be executed that are inaccessible from the web.