Issue with Volusion API

Question

I am creating a website using volusion store. I want the products to displayed on products page and for that I am customizing the code. I have created the volusion api i.e, standard exports and I just need to fetch that products details to page using that api with ajax. so how do I achieve that? For the first type I have created api with .xml extension e.g, https:///dataport/dl/Generic/Products.xml then it shows the data and I can also fetch that data but for the second type of url e.g, http:///net/WebService.aspx?Login=&EncryptedPassword=&EDI_Name=Generic\Products&SELECT_Columns=p.ProductID,p.ProductName,pe.Photo_AltText,pe.Photo_SubText,pe.PhotoURL_Large,pe.PhotoURL_Small,pe.Price_SubText,pe.Price_SubText_Short,pe.ProductPrice,pe.ProductPrice_Name I can't able to fetch that data using ajax. Although using this url for the first time it shows data but when I refresh it then it doesn't show.

Below I have shared my code so please review it and help me to solve this issue,

<script>
    $(document).ready(function(){

$.ajax({
    type: "POST",
    url: "http://<domainname.com>/net/WebService.aspx?Login=<username>&EncryptedPassword=<password>&EDI_Name=Generic\Products&SELECT_Columns=p.ProductID,p.ProductName,pe.Photo_AltText,pe.Photo_SubText,pe.PhotoURL_Large,pe.PhotoURL_Small,pe.Price_SubText,pe.Price_SubText_Short,pe.ProductPrice,pe.ProductPrice_Name",
    dataType: "xml",
    success: function(result) {
        alert(result);
        parseXml(data);
    }
});

});
function parseXml(data) {
    var id;
    var code;
    var name; 
    $(data).find('Products').each(function( ){ 
        $(this).find("ProductCode").each(function() {
            code = $(this).text();
        });
        $(this).find("ProductID").each(function(){
            id = $(this).text();
        });
        $(this).find("ProductName").each(function(){
            name = $(this).text();
        });
        $('.col-md-6').append(code +"<br />"+ id +"<br />"+ name);
    });
}

</script>
<div id='getresult'>
    Api code will refelect here
    <div class="container">
        <div class="row">
            <div class="col-md-6"></div>
        </div>
    </div>
</div>

Never, ever, ever use your Webservice login email address and the Encrypted Password in any client side code. If you do you might as well post it here because there is no difference. You are pretty much giving anyone a free pass to your site. DO NOT DO IT! — user357034, Dec 06 '15 at 18:15
I didn't see that, thanks for pointing that out. Similarly, I gave you an example of using your API through JQuery, that is not safe, I was so exhausted I couldn't think of why not to say, so I said I didn't think it would work. If you need the information I will get it to you if you get in touch with me am going to remove the part on j query from my answer as it's end user security risk, and not PCI compliant... But if you try to explain more clearly what you want to accomplish than I can probably help you get the data without the API if it's product info on a product page.... — Tim, Dec 07 '15 at 01:25

score 0 · Answer 1 · edited May 23 '17 at 12:30

Absolutely Do Not Use This Method. Security Risk. Proceed to Second Section, Jquery Answer Deleted.

How to do the java data call with jquery

I've not had much luck using jquery to do it. But you might want to try something like this to do the jquery load you're attempting... you might want to check what version of jquery you're loading also as volusion gives you an old version for some reason. Add this to your template.html that you're using currently. you might need to upload it into your server with the other javascripts using ftp...

<head>
<script src="//ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js"></script>
</head>

On the page you want to access the data try this. (no promises but you need to double check your code syntax it seemed pretty off to me, you also have to have a where clause in your query if you're not using a custom asp page.)

Script Removed As It Is Exploitable, and I refuse to promote unsafe practices in commerce.

Securely Accessing the Volusion API Webservice With Custom Queries and Connections using a custom asp page.

Use a Custom ASP Page for your own service Volusion does not support asp.net for custom scripts but you can use asp classic. You can make an asp page through the following method.

Using XML read the querystrings, I suggest putting in code to sanitize it. For Example:

dim oXMLHttp
dim Xml_Returned

set oXMLHttp = Server.CreateObject("Msxml2.serverXmlHttp")
oXMLHttp.open "POST", "http://YourUrl/net/WebService.aspx?
Login=YourEmail@YourDomain.com&
EncryptedPassword=YourPassword&
API_Name=Generic\Orders&SELECT_Columns=o.OrderID,o.OrderStatus,od.TotalPrice&
WHERE_Column=o.OrderStatus&WHERE_Value=New", False

oXMLHttp.setRequestHeader "Content-Type", "text/xml; charset=utf-8"
oXMLHttp.setRequestHeader "Content-Action", "Volusion_API"
oXMLHttp.send

Xml_Returned = oXMLHttp.responseText

For More Information See Volusion Developer Documentation Samples

Construct your SQL Query off of your querystring..
Define your query string as a variable, your api connection string as a constant, and input it through the url. you can do a post but it's faster to just do a get.
Write a custom sql file and save it in your generic folder that matches the query you want to make. Or, use vb's File System Object to create it on the http request.
Create a xml schema file and store that inside the Schema/Generic folder as well.
Now you call this file by hitting it with an httpget in java, YOURURL.COM/v/vspfiles/schema/generic/YOURCUSTOMSCRIPT.ASP?CUSTOMWHEREVARIABLEORWHATEVERITIS=THISISYOURMODIFIERUNLESSTHEQUERYISSTATIC
If you created the sql file using asp's fso, delete the file after the call is made.
Return the data into the javascript requesting it.

See The answer from "TheCodeWhisperer" Posted on May 7 at 14:37 for a Example Code Doing Just What I'm Saying Here.

Now I know this is a bit brief, but each result is different and this is how i know to do it, it's just more versatile for me over using jquery.

Here are some additional links for your reference. Let me know if you need more help.

You should be able to use this method. The following links will help. If you don't get anywhere i'll help you as soon as I have some more time.

Issue with Volusion API

1 Answers1

Absolutely Do Not Use This Method. Security Risk. Proceed to Second Section, Jquery Answer Deleted.

Securely Accessing the Volusion API Webservice With Custom Queries and Connections using a custom asp page.

REFERENCES: