Interchange FAQ: Frequently Asked Questions

Mike Heins

This documentation is free; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

It is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

Abstract

The purpose of this FAQ is to provide quick answers to quick questions. Where ever appropriate, pointers to more "formal" documentation (guides, HOWTOs, reference pages) will be provided.


1. Interchange Installation
1.1. How do I install Interchange?
1.2. Configuration Problems
1.3. Proper file ownership and permissions
1.4. Error -- the Interchange server was not running...
1.5. Config.pm not found
1.6. Can't locate lib.pm in @INC. BEGIN failed--compilation aborted.
1.7. Segmentation fault or other core dump
1.8. Configuring catalog whatever...Use of uninitialized value at Config.pm line 1614, <config> chunk 322.
1.9. Why isn't the above error more enlightening?
1.10. XXXXXX.pm does not match executable version.
1.11. Can I run Interchange on Macintosh or Windows?
1.12. Error - 'make: command not found'
1.13. Templates aren't showing, only the center content of the page itself
1.14. When I try to install the RPM packages, I get "failed dependencies" errors
2. How does Interchange work
2.1. Where are the pages?
2.2. Where are the images?
3. SSL problems
3.1. Shopping cart is dropped when using SSL.
3.2. I have a different secure server domain. Why does the shopping cart get dropped?
3.3. My images aren't there on the secure server!!! (With the !s and all)
3.4. My secure pages fail when the browser is MSIE.
4. ISP problems
4.1. General problems
4.2. No shell access allowed on my ISP.
4.3. We're sorry, the Interchange server is unavailable...
4.4. Document contains no data or premature end of script headers (especially on BSDI or FreeBSD).
4.5. Interchange server only runs for a while, then dies.
4.6. My entire home directory is in HTML document space.
5. System configuration
5.1. Can I run multiple catalogs on one server?
5.2. How do I start Interchange when I reboot?
5.3. I installed the Interchange RPM, and I can't restart.
5.4. How do I set up a mall?
6. Product options
6.1. Can I attach a size or color to a product?
6.2. Can I change the price based on size or color (or other attribute)?
7. Encryption
7.1. PGP encryption - Server Error
7.2. PGP encryption - What do I do now that it is working?
8. How do I....
8.1. How do I get the number of items in a shopping cart?
8.2. How do I delete an item from the cart in Perl?
8.3. The demo doesn't do ... (pick one)
8.4. How can I trace the source of a purchase and run a partners program?
8.5. How can I send an email copy of the receipt to a user?
8.6. How do I display Euro pricing?
8.7. How do I empty the shopping cart?
8.8. How do I e-mail credit card numbers in plain text?
8.9. How do I setup multiple shipping addresses?
8.10. How do I change the order number from TEST0001, TEST0002 to something else?
8.11. How do I move a catalog from a test server to a production server?
8.12. How do I access the raw match count?
8.13. How do I add thumbnails to the results page?
8.14. How do I do a random display of items?
8.15. How do I setup a new real time payment processor that isn't yet supported by Interchange?
8.16. How do I modify orders after they are placed, change items, shipping, etc.?
8.17. How do I make or get a certificate for SSL?
8.18. How do I perform multi-table SQL queries and/or joins using dot notation?
8.19. How do I modify the Save Cart and Recurring Cart feature? How do they work?
9. Errors
9.1. Sorting doesn't work across multiple pages.
9.2. I am searching for a string and it is not found. I know it is there!
9.3. Performance issues
9.4. Interchange runs, but it's sooo sllooowww...
9.5. Interchange slows down over time.
9.6. I am using SQL, and Interchange is slow ...
9.7. Using Interchange with apache and suexec
9.8. A friendly reminder
10. Tips and tricks
10.1. Locking down your system

1. Interchange Installation

1.1.

How do I install Interchange?

Interchange pages are not kept in normal HTML space. Instead, they are kept in a special directory pointed to by the PageDir configuration directive (with the default of products/ directory inside CATROOT). The pages served from PageDir are always filtered through the Interchange daemon before being delivered to the clients — it's one of the crucial things that Interchange does.

1.2.

Configuration Problems

Most Interchange configuration and setup problems are due to one of the following:

  • Wrong information given to makecat program.

    This is by far the most common problem. To install a working demo, Interchange needs to know what the Web server DOCROOT is and how to run CGI programs. Details of this setup are server- and site-specific, which may require some research.

    Run the makecat command and pay close attention to the prompts displayed. There are examples given which apply to most systems.

    If the web server is Apache or NCSA, Interchange will try and parse its httpd.conf file to help you along, but many ISPs don't allow users to read these.

  • Too-low version of Perl.

    If you have a Perl earlier than 5.6, Interchange will not work. Don't even try an earlier version.

  • Perl compiled with USE_THREADS.

    Interchange does not work well with threaded Perl installations (it's because of the problems that the "threadness" causes to various Perl modules that Interchange uses). Run perl -V:usethreads; if the response is define, you need at least Perl 5.8.4 to get any results. Even then, we do not encourage the use of threaded Perl with Interchange as it causes about 30% performance penalty.

  • Running Interchange as root

    You cannot run Interchange software as root.

1.3.

Proper file ownership and permissions

If you are setting Interchange up for the entire machine, and not just as a virtual host user, it is usual to create a special interch user to run the daemon and the link program. This means the directory listing for your cgi-bin/ directory should be something like

-rwsr-xr-x   1 interchange users        6312 Dec 30 11:39 cgi-bin/simple

and for the socket file it should be

srw-------   1 interchange users           0 Dec 30 11:41 etc/socket

Once you have set up the software, you can easily install catalogs as root as long as your umask is set to 2 or 22.

(The following assumes you have made the Interchange software owned and run by the special user interch and that each user has a Interchange catalogs directory /home/USER/catalogs).

The best way to set permissions on a multi-user system is to make all files group readable and writable (mode 660 or 664). If you have a system setup that places each user in their own group, make interch a member of each user's group and set ownership and permissions with:

$ find /home/USER/catalogs -print | xargs chown USER
$ find /home/USER/catalogs -print | xargs chgrp USER
$ find /home/USER/catalogs -print | xargs chmod g+rw

For best results, set the user's default umask to 2, so that they will, by default, create files that have the proper permissions. If you have all users in the same group, the above is not secure. You should put interch in a group of which no user is a member (perhaps interch would be a good choice ;-) and set all files owned by the group interch and all directories to mode 2770. This will make files default to the proper group when created (on most UNIX versions, anyway).

$ find /home/USER/catalogs -print | xargs chown USER
$ find /home/USER/catalogs -print | xargs chgrp interch
$ find /home/USER/catalogs -print | xargs chmod g+rw
$ find /home/USER/catalogs -type d -print | xargs chmod g+s

If you are on a virtual hosting system, the procedure varies. Making the program setuid should work for most systems. If your setup uses CGI-WRAP or another setuid scheme, it should still work. However, you may have to unset the setuid bit with

$ chmod u-s cgi-bin/CATALOG_NAME

or the like. If you have a non-standard CGI setup, as some virtual host systems do, you will need to know something about UNIX and the web, or engage a consultant to properly set up the paths. Usually switching to TLINK/INET mode is the easiest thing to do, though with Iserver and a few other hosting companies it may take more than that.

If you used the makecat program to build the catalog, it should have warned you if it was not able to make the link program setuid. To set the program ( cgi-bin/CATALOG_NAME) setuid, use the command

$ chmod u+s cgi-bin/CATALOG_NAME

1.4.

Error -- the Interchange server was not running...

This indicates that the link program is not communicating with the Interchange server.

[Note]Note

The server should always be started by the same user ID which owns the suid link program. As there is no visible socket file and filesystem permissions for TLINK (Inet socket) mode, this note applies to VLINK (Unix socket) setups only.

The server must be running, first of all. If you didn't start it, you can do so by going to the Interchange home directory and typing:

bin/interchange -r

You can check to see if your server is running by typing:

ps aux  | grep interch         # Linux and BSD (BSD style)
ps -elf | grep interch         # Most other Unices (SysV style)

Solaris and IRIX truncate the string, however, and do not allow setting of the $0 parameter, so you might have to grep for perl instead.

If the server is not running, it may have failed due to another process occupying the TCP socket on port 7786. If using VLINK, try starting Interchange with start -u, which will make sure the internet-domain socket is not used.

If VLINK is not communicating with the server, there are a number of possible reasons. First, if you are trying to run Interchange on an ISP, go to the section about ISP problems. It is probably one of those. If you are running Interchange on a single machine, it is probably one of:

1. Permissions problems
2. Interchange on NFS-mounted file system
3. Both of the above ;)

Check the error.log file for your HTTP server — it will almost always tell you what the problem is, unless there is a simple permissions problem.

Permissions are easy. If starting Interchange like this works:

bin/interchange -r SocketPerms=0666

then you have a socket permission problem. Try restarting Interchange without the above adjustment of SocketPerms=0666, and then try accessing it again with each of these mode changes:

chmod u+s cgi-bin/CATALOG_NAME

chmod u-s cgi-bin/CATALOG_NAME

If neither of those work, either the UID of the vlink program is wrong, the vlink program is looking for the socket file in the wrong place, or your HTTP server is interfering in some fashion. If you are running Interchange on an NFS-mounted file system, it cannot run because UNIX-domain sockets don't work on NFS. You will need to change to INET mode from UNIX mode, or better yet, put Interchange on a file system that is directly mounted.

If you have not changed the configured defaults, and still it will not communicate, you should try setting the LINK_FILE (for vlink) or LINK_HOST and LINK_PORT (for tlink) in config.h and recompiling.

You can recompile manually like this:

$ cd interchange-installation-dir/dist/src
$ ./configure
  (edit config.h as described above)
$ gcc -o vlink vlink.c       # For vlink - Unix socket communication
$ gcc -o tlink tlink.c       # For tlink - Inet socket communication
  (copy vlink.c or tlink.c to the cgi-bin directory and rename to your catalog name)

You can use Interchange in INET mode along with the tlink.c program to allow running across NFS boundaries.

1.5.

Config.pm not found

This means your Perl is not properly installed, or that Interchange is not using the proper Perl binary. On UNIX, try reinstalling Interchange and using the standard Perl installation sequence (instead of the shorthand ./configure):

/complete/path/to/proper/perl Makefile.PL
make
make test
make install

1.6.

Can't locate lib.pm in @INC. BEGIN failed--compilation aborted.

Again, your Perl is not properly installed. Someone has put a Perl up on your system, then either moved or removed the library directory. Contact your system administrator and request that Perl be re-installed.

1.7.

Segmentation fault or other core dump

If this happens when you run the Interchange test or server, it is always Perl that has a problem. Not sometimes, always. A proper Perl should never have a segmentation violation, period. And it should not dump core (unless you passed it a -u option somehow).

You will need to either update Perl or report the bug to the proper personnel. Depending on your situation and technical ability, this may be your system admin, ISP, or the Perl porters.

1.8.

Configuring catalog whatever...Use of uninitialized value at Config.pm line 1614, <config> chunk 322.

This is a warning from Perl indicating that an empty value was found where one is expected. The warning is left in so that you know that something is missing. Whatever it is, it can be found at the specified "chunk," or line, of catalog.cfg. If you use the include capability, it would have to be factored in as well.

The usual reason is that a file is specified in one of the directives (usually one of SearchProfile, OrderProfile, or UpsZoneFile) and does not exist. See the documentation for the directive on how the file name should be specified.

1.9.

Why isn't the above error more enlightening?

Because Perl won't tell us what exactly went wrong. See its FAQ for why.

1.10.

XXXXXX.pm does not match executable version.

This is a Perl which does not have the right Perl library installed. It usually results from a naive system administrator who thinks they can bypass the 'make install' for Perl and just copy the Perl binary or directories.

If you installed Bundle::Interchange locally in your Interchange directory, it may mean that your system administrator updated Perl and failed to select the binary compatibility option.

1.11.

Can I run Interchange on Macintosh or Windows?

Interchange will not run on a MacOS 7, 8, or 9 operating system. It will run on Mac OS X and other PowerPC Unix variants.

Interchange's *files* can be manipulated by any computer. As long as uploads/downloads of database source, pages, and configuration files are done in ASCII mode, there is no reason why they can't be edited on a Mac. And with MySQL or other ODBC databases on your UNIX-based ISP, you can even directly interface to the database you use with Interchange provided you have the scarce ODBC middleware needed for the Mac.

Interchange can be run on Windows with the Cygwin tool set (1.3.2 or higher) available from www.cygwin.com, but there are numerous anomalies and it may be difficult to get operating reliably. It is never recommended that you run a production catalog on a Windows system; if you do get it working you should only use for catalog development.

1.12.

Error - 'make: command not found'

The error is caused when the system you are installing on does not have the program called make. It is recommended that you install make as well as a C compiler ("cc" or "gcc") for the installation of Interchange. If you are unsure of how to do this for your operating system, it may help to ask a mailing list related to your operating system.

1.13.

Templates aren't showing, only the center content of the page itself

Did this happened after moving the site to a new host, uploading new catalog.cfg or restarting Interchange?

This can happen if the files were uploaded in binary instead of ASCII (when using FTP), or Windows-style carriage returns were put in the file by a Windows editor or file transfer program. On unix, do an octal dump on some of the files to see if you have the CR chars:

od -a templates/foundation/theme.cfg | grep cr
od -a catalog.cfg | grep cr

If something appears on the screen, then your file needs to be cleaned. Among the other 10-million ways to clean it, here are few:

perl -pi -e 's/\r//g' file.cfg

perl -p -e 's/\r\n/\n/g' < old_file.cfg > new_file.cfg

dos2unix file.cfg

tr -d '\r' < old_file.cfg > new_file.cfg

Also, if you are using FTP to transfer the files from a Windows machine, try using ASCII mode instead of binary mode.

1.14.

When I try to install the RPM packages, I get "failed dependencies" errors

There are, as always, few solutions to the problem:

One, install the modules manually, then use the -nodeps option to RPM during install.

Two, perl -MCPAN -e "install Bundle::Interchange".

Three, properly install RPM modules from the distribution media to satisfy the dependencies.

If, for some reason, you can't use the distribution media, then some modules are available from http://ftp.icdevgroup.org/perl/ while others can be found on rpmfind.net.

2. How does Interchange work

2.1.

Where are the pages?

Interchange pages are not kept in normal HTML space. Look in the catalog subdirectory pages. The pages are always filtered through the Interchange daemon before being delivered.

2.2.

Where are the images?

Interchange is a CGI; program, and if relative image paths were used, erroneous img output like the following would have occured:

<img src="/cgi-bin/simple/../whatever.jpg">

For that reason, by default, Interchange uses ImageDir or ImageDirSecure for a prefix used to rewrite image URLs. In the demo, image specs that have no absolute path information are prefixed with /simple/images/.

In an Interchange page, this tag:

<img src="ordernow.gif">

will become this:

<img src="/simple/images/ordernow.gif">

This tag:

<img src="items/00-0011.jpg">

will become this:

<img src="/simple/images/items/00-0011.jpg">

Absolute image paths are not affected. An image such as /other/images/whatever.gif will not be changed.

3. SSL problems

3.1.

Shopping cart is dropped when using SSL.

If you are using a separate secure and non-secure domain, this is due to the cookies from the user not matching as well as the session ID not being able to be transferred due to differing source IP addresses.

[Note]Note

Interchange does not support this configuration. You may be able to get it to work in some circumstances, but it is not supported. See the next set of questions for help on how you may be able to get it to work to some extent in your configuration. It will not work in every circumstance with every feature.

This is sometimes due to the "HostnameLookups" (Stronghold/Apache parameter) not matching for the two servers, secure and non-secure. It can also be caused by the user having different web proxy addresses for HTTP and HTTPS. Try changing some of the appropriate configuration parameters in interchange.cfg:

DomainTail   No
IpHead       Yes

If you still are having problems, try this combination in catalog.cfg, the catalog configuration file:

SessionExpire  10 minutes
WideOpen       Yes

The above setting will typically make Interchange work when it is possible to work. Sometimes when you have multiple Interchange servers sharing the same secure server, you will have problems after accessing the second one. (The first one issues a session ID cookie, and that causes problems).

3.2.

I have a different secure server domain. Why does the shopping cart get dropped?

First of all, it is questionable business practice to not certify your secure server. Besides violating the terms of use of many certificate issuers, customers notice the changed domain and it is proven by user surveys and long experience that you will receive fewer orders as a result. Certs can be obtained for $125 US per year, less than the typical cost of one hour of a top consultant's time. Do your business a favor - spend the money to get a cert.

If you insist on doing it anyway, probably driven by the fact that you need a dedicated IP address for a secure server, you can use the solutions in the previous FAQ question and get some relief.

But by far the best way is to have all orders and shopping cart calls go only to the secure domain. Your users may get a different session when browsing the non-secure catalog pages, but it will matter little.

To do this on the Foundation demo, place in catalog.cfg:

AlwaysSecure  order ord/basket ord/checkout

A more complete list might be:

AlwaysSecure <<EOF
 account
 change_password
 customerservice
 login
 logout
 new_account
 ord/basket
 ord/checkout
 order
 process
 query/check_orders
 query/order_detail
 query/order_return
 returns
 saved_carts
 ship_addresses
EOF

Add pages of your own that need to be sure of coherent session information.

For all *forms* to be secure, make sure process is on that list. (Your search forms will still be non-secure if you use [process-search] to produce the form action.)

To make individual order links secure, use this instead of [order]:

<a href="[area
  href=order
  secure=1
  form='mv_order_item=SKU'
]">Order it</A>

To make a form-based order button secure, use [process secure=1] as the action.

3.3.

My images aren't there on the secure server!!! (With the !s and all)

You have a different document root, or the permissions are not such that you can access them. You can set a different base URL for images with:

ImageDirSecure   https://myhost.mydomain.local/somewhere/images

3.4.

My secure pages fail when the browser is MSIE.

MSIE has several SSL bugs, particularly in V5.01. See the Apache-SSL or mod_ssl FAQ. You can sometimes fix this with an httpd.conf change:

SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

4. ISP problems

4.1.

General problems

The great majority of ISPs provide some CGI service, and more and more run systems that are compatible with Interchange. Our catalog configurator (makecat) makes setup much easier.

[Warning]Warning

if you chose your ISP mostly on price, you can expect problems. The low-cost providers typically have heavily-loaded machines and many domains. The more domains and the more load the unhappier you will be with Interchange. Interchange works best on a fast machine with plenty of memory.

A few Internet Service Provider (ISP) systems still have difficulty with one or the other aspect of running Interchange. A few cannot (or will not) run Interchange at all. On top of that, many times ISP personnel are too busy to help, won't help, or don't know enough to help. Some are secretive about details of the setup of their systems.

All in all, you can have a fair amount of confidence that your ISP can run Interchange. Or, you can get one who will for sure. 8-)

4.2.

No shell access allowed on my ISP.

Generally it is a waste of time to try to use Interchange without shell access.

4.3.

We're sorry, the Interchange server is unavailable...

(The following assumes that you were able to start the Interchange server).

This could be almost anything, but with a properly configured Interchange it is almost undoubtedly due to your cgi-bin and/or your Interchange directory being located on a different filesystem than the actual machine that is executing the program. VLINK uses UNIX-domain sockets, which don't work on NFS-mounted filesystems.

Iserver.com and other systems which use chroot HTTP servers require quite a bit of extra configuration to get going. If you have not been careful to set permissions properly when running in VLINK/UNIX mode, the link CGI will not be able to communicate with the Interchange server. Please read the documentation that covers this in detail.

You can run in INET mode with the tlink link program to prevent those problems.

4.4.

Document contains no data or premature end of script headers (especially on BSDI or FreeBSD).

This usually means that your HTTP server ran out of resources during the execution of the link program. It couldn't create more sockets, is unable to create a process, or can't open any more files.

This usually happens in catalogs containing frames, when Interchange is sending more than one page simultaneously. And even more especially on FreeBSD and BSDI, which are often distributed with the kernel parameters SOMAXCONN and CHILD_MAX set to levels unsuitable for serving the web.

Go to www.deja.com and try searching for MAXUSERS. This should give you plenty of pointers on how to set these parameters properly.

4.5.

Interchange server only runs for a while, then dies.

Many ISPs don't allow your user ID to run a program unless it is logged in! The moment a watchdog program notices a daemon running with a non-logged-in UID, it terminates the program. Or, it terminates programs that haven't been active for some time. Contact your ISP about this. They may be able to do something for you.

4.6.

My entire home directory is in HTML document space.

If working with an ISP where all of the files are in HTML document space, disable all access to the Interchange catalog directory with the proper HTTP access restrictions. Normally that is done by creating a .htaccess file like this:

<Limit GET POST>
  order allow,deny
  deny from all
</Limit>

If unable to do this, do not run Interchange unless file permissions can be set such that files will not be served. However, security will be a problem and customers' personal information could be placed at risk.

5. System configuration

5.1.

Can I run multiple catalogs on one server?

Yes. Interchange supports multiple independent catalogs. There are users who run more than 500 catalogs on a single machine. The capacity is usually a function of how busy the catalogs are and how much memory and processor speed your system has.

5.2.

How do I start Interchange when I reboot?

Use the standard facility on your operating system. For BSD-style systems, the file is usually called /etc/rc.local.

On SVR4 systems, it is quite a bit more complex. Look for the /etc/rc.d directory and see what other programs do. Often the file is called S99startup or something similar.

Linux systems have a SysV init scheme as well. Our Debian GNU and Red Hat packages already include the proper init script for those systems.

[Caution]Caution

Interchange must not run as root. The technique to start up the daemon under a different username depends on the facility of your su(1) command. However, this should work on most systems:

su interchange <<EOF
/your/interchange/dir/bin/restart
EOF

The EOF must be the only thing on the line (no leading or trailing whitespace). If your su(1) command has a -c option (as most System 5 UNIXes do), you can just do:

su -c /your/interchange/dir/bin/restart interchange

Interchange supplies a restart script which tries to do the above portably. It works on many operating systems.

5.3.

I installed the Interchange RPM, and I can't restart.

This usually means that you tried to run /usr/lib/interhcnage/bin/interchange. which fails to take into account the Linux Standard Base (LSB) file setup. Instead, run

/etc/rc.d/init.d/interchange restart

or

/usr/sbin/interchange -r

5.4.

How do I set up a mall?

Interchange can share product databases, session files, and any other databases. It has many features which support mall building. You can easily build separate and mostly identical catalogs which you link to via HTML. But building a mall is as much an exercise in data and process as in software. Consider the following questions:

  • Who will be clearing payment?

  • What happens if everyone doesn't have the same tax rate?

  • How will you clear orders to multiple vendors?

  • How will you bring together multiple types of shipping?

  • How will the vendors get product data (including images) to you?

If you cannot answer those questions and visualize how to build a mall, you probably should not try.

6. Product options

6.1.

Can I attach a size or color to a product?

Interchange has product modifiers, or attributes, which can be carried around with the product. Inside an item list or the product page (flypage), the item-options tag will automatically place suitable widgets on an HTML form, and "remember" what should be selected. See the attribute glossary entry for complete information.

You can use the SeparateItems directive or set the mv_separate_items variable on the order form to cause ordered items to be put on separate lines in the shopping basket (this is the default in the demo catalogs).

6.2.

Can I change the price based on size or color (or other attribute)?

Yes. Use the Interchange UI to set up your product options. It operates on the options database table to set up options that can affect price.

7. Encryption

7.1.

PGP encryption - Server Error

As always, check the error log. The most common problem is something like:

> Encryption error:
> akopia.com 3Ex5lvta:akopia.com - [01/Sep/1997:09:08:43] simple /cgi-bin/simple

Check the ScratchDir (usually tmp/) for *.err files; they will contain PGP or GPG's error output.

Probable causes:

  • Interchange user ID doesn't have keyring. You must have a .pgp or .gnupg directory in the home directory of the interchange daemon user. It is also possible to set an environment variable (variously PGPPATH or GNUPGHOME) to orient the program correctly.

  • EncryptProgram directive set wrong. In Interchange 4.7.7 and above, you only need to specify gpg, pgp or pgpe. The key is set in EncryptKey. If you don't set a value for EncryptProgram, Interchange will look for gpg first, then pgpe, then finally pgp, using the first it finds. If it can't find one of those, it is set to none and encryption can't be done. You can specify a full path to the program in the directive, but no arguments need be set (old values in EncryptProgram will still work, just are not needed).

7.2.

PGP encryption - What do I do now that it is working?

This depends on what you do with orders once you receive them by email. Some PC mail agents (notably Eudora) will decrypt the PGP message embedded within the message text. In that case, you can simply embed the [value mv_credit_card_info] call right in the message and be done with it.

If your mailer will not decrypt on the fly, the best way to read the credit card number is to set up MIME encoding of the order email. To do this, find the order report you are using. In the standard demos it is pages/ord/report.html or etc/report.

Set up two MIME regions in that file. First, at the top of the file insert:

[tag mime type TEXT/PLAIN; CHARSET=US-ASCII][/tag]
[tag mime Order Text]

  ORDER DATE: [calc]localtime[/calc]
  ORDER NUMBER: [value mv_order_number]

  Name: [value name]
  Company: [value company]

  [comment] Rest of order text, including item list [/comment]

[/tag]

Then, at the bottom of the report.html file, put the credit card info:

[if value mv_credit_card_info]
  [tag mime type application/pgp-encrypted][/tag]
  [tag mime Credit Card Information]
  
    [value mv_credit_card_info]
  
  [/tag]
[/if]

Once this is done, you can read mail using your PGP client as a helper application to decode the MIME attachment. This does not require a fancy setup - you can use the standard MIT PGP 2.6.2 if desired. If you are using UNIX, set up as the helper for the MIME type application/pgp-encrypted:

xterm -e pgp -m %s

More automated or user-friendly setups are left as an exercise for the user.

8. How do I....

8.1.

How do I get the number of items in a shopping cart?

If it is simply the total number, extended according to quantity, you can use the nitems tag. If you need this number for use in an embedded Perl script, you can use:

$number = $Tag->nitems();

If it is the number of line items you need, then you can use a Perl script:

[perl]
  return scalar @{$Carts->{main}};
[/perl]

(The 'main' above refers to the main shopping cart.)

If you have SeparateItems in effect, and need the number of unique items, you could use:

[perl]
  my $cart = $Carts->{main};
	my $item;
  foreach $item (@$cart) {
    @items = split /\|/, $items;
    $count = 0;
    for (@items) {
      $count++ unless $seen{$_}++;
		}
	}
  $count;
[/perl]

8.2.

How do I delete an item from the cart in Perl?

[calc] @$Items = grep {$_->{code} ne '123.456.789'} @$Items [/calc]

('123.456.789' is the SKU of the product you want to delete, of course).

8.3.

The demo doesn't do ... (pick one)

That is because it is a demo. It is not intended to be a finished catalog, just a starting point.

That being said, you should think long and hard before abandoning the checkout schema. Years of experience have led to the production of the userdb, transactions, and orderline tables, and the structure of the checkout page. Any changes to the data structure should be thoroughly tested before deployment, as obscure errors can cause major problems in order logging.

8.4.

How can I trace the source of a purchase and run a partners program?

Interchange has a facility that adds a parameter called source to the session database for that user. You should give your partners a source code, which must contain at least one letter character (A-Za-z only). It is placed in the sourcing URL as a query string of:

mv_pc=Source1

If this is appended to the URL with which the user calls Interchange, it will then be placed in the session identifier source. URL http://myhost.mydomain.local/cgi-bin/ic/sp_offer?mv_pc=Source1 would yield Source1 from the Interchange call [data session source].

The Minivend 3 idiom ?;;Source1 continues to be supported, so existing partner sites should work without change.

8.5.

How can I send an email copy of the receipt to a user?

There are several ways, but this is a more complex question than it may seem. You will have to deal with bad email addresses, deciding which information to send, showing delivery times, etc. You also have to be very careful with credit card information. If you have not taken the proper security measures (by enabling PGP credit card encryption or using CyberCash), you might just mail them their own unencrypted credit card number!

This is supported in Interchange via a email or related tags linked from there.

8.6.

How do I display Euro pricing?

You can use Interchange's internationalization facilty via the Locale directive. In catalog.cfg:

# to define the euro-Settings (PriceDivide is for converting from DM)

Locale eur_EUR PriceDivide         1.95583
Locale eur_EUR p_cs_precedes       0

# this is great - you can even use HTML-Tags to display an euro-image
Locale eur_EUR currency_symbol     "<img src="/path/to/image/euro.gif">"
Locale eur_EUR p_sep_by_space      2
Locale eur_EUR mon_decimal_point   ,

# and the DM
Locale de_DE
Locale de_DE p_cs_precedes  0
Locale de_DE p_sep_by_space 2

Be sure to use the latest exchange rates when you establish your catalog. On your pages (this is from a search results page, the [item...] notation may be different depending on your context):

[item-price]<br>    [comment] german is default [/comment]
[setlocale eur_EUR]
  [comment]EURO[/comment]
  [currency  convert="1"][item-field price][/currency]<br>
[setlocale]

8.7.

How do I empty the shopping cart?

Here are three examples of ways to empty/drop/clear the shopping cart contents.

Empty the cart:

[calc]
  @{$Carts->{$CGI->{mv_cartname} || 'main'}} = ();
[/calc]

Empty the cart on a button press:

[set clear_basket]
  [calc]
    @{$Carts->{$CGI->{mv_cartname} || 'main'}} = ();
  [/calc]
[/set]

[button text="Clear Basket" src="clear_basket.gif" hidetext=1 form=basket]
  mv_todo=refresh
  mv_click=clear_basket
[/button]

Delete user session (emptying cart as a consequence):

[button text="Clear Basket" src="clear_basket.gif" hidetext=1 form=basket]
  mv_todo=cancel
  mv_nextpage=index
[/button]

8.8.

How do I e-mail credit card numbers in plain text?

The position of Interchange Development Group is that we will not tell you what you can and cannot do, but that we simply will not help you send unencrypted CC numbers by email.

8.9.

How do I setup multiple shipping addresses?

Interchange has the facility to handle multiple addresses. See UserDB.

8.10.

How do I change the order number from TEST0001, TEST0002 to something else?

Go to the IC admin, click on "Administration" then click on the 'last order' which will be something like "TEST00001". It will bring up a page which will allow you to change it to whatever you want.

Alternatively, without the GUI, modify etc/order.number in your catalog.

8.11.

How do I move a catalog from a test server to a production server?

  • Copy the complete catalog root with all files and subfolders.

  • Make sure the permissions are appropriate (Interchange daemon user needs rw access to all of it.

  • Link error.log to /var/log/interchange/catalog/error.log or wherever.

  • Link catroot/images to images folder in your public html space.

  • Link the admin ui images folder 'Interchange' in public html space to actual location.

  • Copy any global usertags which are not in your catalog structure.

  • Edit the variable.txt to set appropriate domain names if these have changed.

  • If using MySQL/Postgres/Oracle, set up database access.

  • Put a link program in your cgi-bin, make sure it is chmod u+s and owned by the Interchange daemon user.

  • Add the catalog to the interchange.cfg file.

  • Restart Interchange.

  • Check global error.log for any error messages.

8.12.

How do I access the raw match count?

[value mv_search_match_count]

8.13.

How do I add thumbnails to the results page?

It's as easy as <img src="thumb/[item-field thumb]">, but you may want to add a check to see if the image is actually there before you try to display it:

[if file images/thumb/[item-field thumb]]
        <img src="thumb/[item-field thumb]">
[/if]

8.14.

How do I do a random display of items?

If you are using mysql (and others probably), you should be able to add "ORDER BY RAND()" to your SQL query. For example:

[query
  list=1
  sql=|SELECT * FROM products ORDER BY RAND() LIMIT 3|
]
[list]
  [sql-param description]<br>
[/list]
[/query]

8.15.

How do I setup a new real time payment processor that isn't yet supported by Interchange?

If the payment processor that you would like to use isn't supported by Interchange out of the box, then a new payment module would need to be developed for that processor before you could use them.

If you are up to the task of programming a new payment processor module yourself, the Interchange Development Group would be happy to add your contribution to the growing list of Interchange-supported payment processors. Feel free to take a look at the lib/Vend/Payment directory to see examples of current payment modules.

If developing the module on your own isn't an option, you may engage a competent Interchange developer to do it for you or use one of the already-supported payment modules. TODO: commercial support plug

8.16.

How do I modify orders after they are placed, change items, shipping, etc.?

Example question: "Occasionally, I need to modify orders... Add an Item, Change shipping, etc. What is the best way or how can it be done?"

The Foundation template does not have this functionality "out of the box". While one can manually modify the tables via the Admin UI, it would not cause Interchange to automatically recalculate subtotals, tax, shipping, etc. to account for the modifications.

Until someone gets the "itch" to program that feature into the Admin UI, some users are solving the problem by handling all of these modifications in a Back Office / Accounting / ERP software system. For example, Interchange comes with "out of the box" support for integration with Quickbooks. At that point, however, it becomes necessary to analyze what (if any) syncronization will be performed between the two systems.

8.17.

How do I make or get a certificate for SSL?

This is handled separately and independantly from Interchange, and there are lots of documentation on buying and installing certificates for your platform and http server, as well as generating certificate signing requests (CSR). Companies such as GeoTrust and Thawte sell certificates, and often have some documentation on what the process entails. The Apache, mod_ssl, and OpenSSL user groups may be of assistance as well.

While it is technically feasible to generate your own self-signed certificate, modern browsers will display a warning if the certificate is not signed by a signing authority known to that browser.

8.18.

How do I perform multi-table SQL queries and/or joins using dot notation?

Example question: "How come I can't use [sql-param tablename.fieldname] notation when I do a multi-table query?"

DBI simply does not support tablename.fieldname in the return value. You can just refer to them by the fieldname. In the case of field names that are the same but need to be selected from different tables, you can use SELECT orderline.quantity as o_quan,... and refer to it as [sql-param o_quan].

8.19.

How do I modify the Save Cart and Recurring Cart feature? How do they work?

The code for these features is in templates/components/cart. The relative portion that is executed first when you call the basket page is this:

[button text="Save This Cart" src="__THEME__/savecart.gif"
  extra="class=contentbar2" hidetext=1 form=basket mv_check="Save This Cart"
]
  mv_todo=return
  mv_nextpage=ord/basket
  save_cart=cart
[/button]


[button
  text="Set As Recurring Order" src="__THEME__/saverecur.gif"
  extra="class=contentbar2" hidetext=1 form=basket
  mv_check="Set As Recurring Order"
]
  [set save_cart]recurring[/set]
  mv_todo=return
  mv_nextpage=ord/basket
  save_cart=recurring
[/button]

This creates two buttons that set save_cart to either 'cart' or 'recurring', then go to the ord/basket page (where you are already). When clicked, one of these two code blocks will be executed:

[if value save_cart eq 'recurring']
  <form action="[process-target]"  method="POST">
    To save this recurring order, give it a nickname,
		then press 'Save Cart'.<br>
    Nickname:
    <input  type="TEXT" name="c_nickname"  size="11" value="[scratch just_nickname]">
    <input  type="hidden"  name="mv_session_id" value="[data session id]">
    <input  type="HIDDEN" name="c_recurring" value="1">
    <input  type="HIDDEN" name="save_cart" value="recurring">
    <input  type="HIDDEN" name="mv_todo" value="return">
    <input  type="HIDDEN" name="mv_check" value="Save Cart">
    <input  type="SUBMIT" value="Save Cart">
  </form>

[elsif value save_cart eq 'cart']

  <form action="[process-target]"  method="POST">
    To save this cart, give it a nickname, then press 'Save Cart'.<br>
    Nickname:
    <input  type="TEXT" name="c_nickname"  size="11" value="[scratch just_nickname]">
    <input  type="HIDDEN" name="c_recurring" value="0">
    <input  type="HIDDEN" name="save_cart" value="cart">
    <input  type="HIDDEN" name="mv_todo" value="return">
    <input  type="HIDDEN" name="mv_check" value="Save Cart">
    <input  type="hidden"  name="mv_session_id" vlaue="[data session id]">
    <input  type="SUBMIT" value="Save Cart">
  </form>

[/elsif]

The "nickname" for the cart is set earlier via:

[if !scratch just_nickname]
  [seti just_nickname][tag time]%b-%d-%Y[/tag][/seti]
[/if]

The real work is done because of this chunk:

<input  type="HIDDEN" name="mv_check" value="Save Cart">

which calls the following code after the the user clicks "Save Cart":

[set Save Cart]
  mv_todo=return
  mv_nextpage=ord/basket
  save_cart=none
  [save_cart nickname="[value c_nickname]" recurring="[value c_recurring]"]
[/set]

Which in turn calls the usertag save_cart with a nickname parameter and a recurring parameter. Depending on which button was clicked, recurring will either be 0 (for "Save This Cart") or 1 (for "Set As Recurring Order"). The save_cart usertag adds the cart to the userdb.carts field as a Perl data structure (hashes, arrays, etc.).

9. Errors

9.1.

Sorting doesn't work across multiple pages.

If you are using the [sort table:field] idiom, it cannot. It sorts data present in the list only.

9.2.

I am searching for a string and it is not found. I know it is there!

Set mv_substring_match to yes (su=yes in one-clicks). This most commonly happens when searching for non-ISO-8859-1 (Latin2, Cyrillic, or characters like umlaut and eacute) characters in word-match mode. The problem is, that unless your locale is set up properly, Perl doesn't think a non-ISO-8859-1 and a space character is a boundary.

Also, if you are searching for non-alpha characters, they will also not be interpreted as word characters and the boundary problems will still exist.

9.3.

Performance issues

Interchange is not a lightweight program. If you are running it on a low-end ISP, whose major selling point is low cost, you will frequently find that Interchange performance is very poor.

If memory is low, the program will "swap" to disk. If lots of swap is used, you can expect very bad performance. This is the most common speed problem. If your ISP uses IDE hard disks, you can expect REALLY bad performance. IDE disks are very slow for multi-user machines, which should have SCSI if ANY swapping is to be done.

If there is a huge amount of traffic on the system, then it can run at a very high "load average." If the machine's load average is routinely above 2, you can expect problems.

If it is an old machine, it may be too slow for Interchange. A Pentium of less than 300MHz is probably not good enough unless it is completely dedicated to Interchange. The faster the processor, the happier you will be.

9.4.

Interchange runs, but it's sooo sllooowww...

This is almost certainly due to a system that has inadequate memory or network bandwidth. On a moderately fast ISP server with sufficient memory, pages should start displaying in less than 2 seconds. On a fast server, pages should start loading almost instantaneously.

9.5.

Interchange slows down over time.

There are many possible reasons for this, but most have to do with memory or session database size.

Learn how to expire Interchange session database. If it is megabytes in size, accessing a key will significantly slow down the session.

Second, if your machine is memory-poor, you will find that Interchange gets swapped to disk. Unless your system is very fast, this will greatly hurt performance. Interchange works best on a machine that rarely if ever swaps to disk.

Third, this often has nothing to do with Interchange at all but has to do with your HTTP server. Any long-running daemon has the potential for a memory leak. Try stopping and starting your HTTP server and seeing what happens to performance.

9.6.

I am using SQL, and Interchange is slow ...

It isn't Interchange. First of all, did you index your 'SKU' or other key fields? The reason Interchange doesn't do it for you is that every SQL database seems to do that a bit differently. Even then, you can try Interchange's COLUMN_DEF parameter:

Database  products  COLUMN_DEF  code=char(16) PRIMARY KEY

This will at least index the code field for MySQL. Other databases differ. Interchange can return VERY fast SQL search results. But you need to at

least give it something to work with. The proper method for fast selection is:

[query sql="select code,category,title,price from products" ]

Category: [sql-param category]<br>
Title:    <a href="[area [sql-code]]"> [sql-param title] </A><br>
Price:    <a href="[area order [sql-param 0]]"> [sql-param price] </A><br>
[/query]

This is especially powerful when you consider a joined query like:

SELECT code, price, title, extended.desc
FROM   products, extended
WHERE  products.category = 'Renaissance'

Note that the extended.desc field will be accessed as [sql-param desc]. Don't forget that you must index your fields if you want fast searching with them as a criteria.

9.7.

Using Interchange with apache and suexec

Apache with SUEXEC: VLINK/UNIX socket mode will not work well unless installed as a normal user. If supporting multiple users, the TLINK/INET mode must be used.

9.8.

A friendly reminder

When in doubt, restart the server. It won't take but a few seconds, and changes in configurable options don't take effect until it is done. You may even change a page and not see the effect until the server is restarted.

10. Tips and tricks

10.1.

Locking down your system

Interchange has lots of built-in protections to make developing your catalogs pretty care-free. But it will definitely pass you the ammo to shoot yourself in the foot, as will any templating system that has power. So you have to be careful, as you do in any scripting environment.

Most of the protections have to do with:

  • Tags like cgi or data are not reparsed for tags.

  • The [value foo] tag never allows a left square bracket to be output.

  • Safe module is used for Perl, which means that arbitrary Perl code which reads/writes or uses IO is not possible.

  • The Interchange files don't need to be readable or writable by any other user ID, so CGI/PHP programs run by the web server can't get at them.

  • Dangerous operations are allowed only via global UserTag, and not by catalog UserTag.

But there are ways that user-entered data could end up getting parsed for tags. The most common breach is to take possibly tainted user data entered into a form and put it in a database without filtering it first. There are several ways to do that:

For user-entered form fields like name, address, etc you should always use the [value ...] tag to display them. You can filter lists of variables automatically with

Filter  name     textarea_put
Filter  address  textarea_put
Filter  comments textarea_put
Filter  email    textarea_put

in catalog.cfg.

You can prevent problems in some cases by using the data tag (i.e. [data table=foo col=bar key="[item-param something]"]) which is not reparsed for tags as item-data is. This is not foolproof unless you control the key in some fashion - in most cases, you will use [data session username] or something else you control.

You should never put user-entered data directly in a scratch variable which can be called with mv_click and mv_check.

Process all user-entered data before putting it in a database that could be displayed in a page later. Or process it before it is displayed.

When putting data inside a container tag, the output of which is reparsed for more tags by default, consider setting reparse=0.

There are other ways to nail down your system and make it more difficult to have a security problem. Use the WRITE_CONTROL database settings.

Database products WRITE_CONTROL 1

It is the default for MV DBM databases (i.e. you have to have a [flag type=write table=foo] to write) but not for SQL. The UI does the proper write flagging, so this should have no effect on it.

[Note]Note

I should have made WRITE_CONTROL the default for SQL in MV4, my bad. As long as MV3 compatibility was as poor as it turned out to be, I should have gone for it.

Enable NoAbsolute in interchange.cfg, it prevents [file /some/dir] or [include /some/rogue/file] from being used. This is the default starting with IC 4.7.x.

Split the admin server onto a different IC iteration from your production catalog, and disable the UI for the production catalog. That allows you to set the pages/ directory to be read-only for the production server, and to put WRITE_CONTROL in the production catalog_after.cfg.

You could also use a different username to access the SQL data, and make the production server username have read-only access.

You can use a different UID for the admin server iteration, and make all directories except products/, upload/, tmp/, session/, and logs/ read-only for the production server UID.

Make as much stuff read-only as you can. Develop a script which sets things read-write while you are admin-ing, and read-only otherwise.

Always make *.cfg, bin/*, and lib/* read-only for the Interchange user.

Don't let the Interchange daemon user ID have read or write permission on things it doesn't need.

Never use AllowGlobal in production if you have user-entered data going into a database. (AllowGlobal is not the default, so many people won't know what it is).

All in all, Interchange has been proven to be securable over time. But we all have to do our part and think about what we are doing with user-entered data.

DocBook!Interchange!