|
The installation of the database server, Theatre Manager and web sales is relatively simple and can be done in a few minutes. |
Achieving PCI compliance for your venue comes with how you install it on your network and other protections you put in place. These protections are mandated by PCI standards regardless of whether or not you use software in your operation. We hope that our instructions make it easy for a merchant to meet PCI DSS compliance.
![]() |
We have placed alerts similar to this throughout the installation documentation to signify areas of particular concern to the PCI standards council. Please pay particular attention to these alerts as they contain valuable information to assist venues meeting PCI compliance. |
The steps that follow indicate how to install and run Theatre Manager in a manner that will help you meet your PCI compliance requirements as outlined in the PCI 1.2 quick reference guide. A venue that chooses to opt out of some of the safety and security measures in this document needs to be aware that they have chosen to bypass some aspects of the compliance required in the merchant agreement with their bank and the PCI Security Standards Council that is operated by the credit card companies.
Venues may opt out of any compliance step by signing the appropriate area. The credit card companies have placed the onus on all point of sale software providers to help merchants meet compliance (instead of the banks) and highlight areas to address.
Theatre Manager assists you in meeting PCI compliance because:
| Step | Purpose | Optional | Installation instructions or link | Who |
| 1. | Network Setup | Mandatory | Setting up network for PCI compliance | Artsman Venue |
| 2. | Installation of Postgres Server | Mandatory | Platform specific install instructions | ArtsMan |
| 3. | Installation of Theatre Manager | Mandatory | Platform specific install instructions | Venue |
| 4. | Installation of a customer database | Optional | If this is the first time that Theatre Manager is being installed at a venue, an 'empty' venue specific serialized database will be provided. It will only contain the zip code lookup table and sample code tables. | ArtsMan |
| 5. | Credit Card Authorization | Optional | Theatre Manager provides two options for credit card authorization.
|
Venue Artsman |
| 6. | Installation of the Apache Server | Optional | Installation of the apache server is platform specific if you are using web sales. | ArtsMan |
| 7. | Setup SSL certificate | Optional | If you are using web sales, you must set up an SSL certificate and configure your firewall to allow web traffic. You will need to set up a DNS record for 'tickets.yourvenue.org' rather than assigning the SSL to a static IP address. | ArtsMan |
| 8. | Upgrade of existing web pages | Optional | This step indicates the general changes to existing web pages that must be made when migrating from any version to any other version.
In addition, a venue must be aware of OWASP and should bookmark it in their browser. This site has a 'top 10' list of ongoing security considerations and standards for web site development. Arts Management reviews and implements each years suggestions annually - see this years top 10. Finally, if you accept credit cards on the internet, you may need an application firewall as per PCI requirement 6.6 and the web pages are significantly changed. We are looking at mod_security and may put that into a future release of the apache server on your behalf. |
Venue |
| 9. | Initial settings in TM | Mandatory | After Theatre Manager and the database have been installed, you will need to review minimum key standards and other security features for PCI compliance. | ArtsMan Venue |
| 10. | Remote Access | Optional | This step is a discussion on remote access and what a venue need to do if they wish to provide that for themselves, for Remote Box Offices.
There are considerations for using RDP within the network and enabling security. Arts Management uses a tool for remote remote support called teamviewer. |
ArtsMan Venue |
| 11. | Policy Manual Additions | mandatory | These are some policies that should be added to the customer service and/or security policy manual at a venue for PCI compliance. | Venue ArtsMan |
The software or hardware provided by any vendor is only a portion of the merchant's ability to meet PCI compliance. Software provided by vendors must meet the PABP 1.4 standard prior to Sept 2010 and the PA DSS 1.2 standard after that date (red) to assist the merchant meet overall PCI compliance.
Meeting compliance requires some due diligence and is determined by the PCI compliance level your organizations needs to attain. Unless you are using old fashioned dial up credit card authorization terminals, the minimum level for Face-to-Face merchants is Schedule C.
The life cycle of a standard provided by the PCI Security Standards Council is approximately every 2 years.
The following table illustrates a brief historical summary of Theatre Manager PCI compliance
| Version | Standard | Status | Action |
| 6 | **Self Assessed | implements most of PCI security features including medium card encryption and should not be considered PCI compliant. | Upgrade to version 9 ASAP |
| 7 | **Self Assessed | implements almost all standards required of PABP 1.4, including high encryption of cards and does not store any track II or CVV2 information. However, this version is neither audited nor certified. | |
| 8 | PABP 1.4 | meets the PABP 1.4 standard and was certified in Oct 2008. Please refer to our certificate and approval by Visa - page 6. | |
| 9 | PCI PA/DSS 1.2 | Meets the PCI PA/DSS 1.2 standard and approved by the PCI council in Dec 2010. |
Upgrade by Jan, 2011 |
** Please note: PCI requirements have changed over the years. At one time, the PCI security council required that vendors of software 'self assess' that they have followed the guidelines. At Arts Management, we have always taken card security and privacy of information seriously and implemented many PCI features before there were published rules. That is why we felt able to meet the self assessment criteria in force at the time. However, there is a much greater need for security than ever before and we encourage merchants to fulfill their obligations to merchant agreements and upgrade to the 'certified' versions of Theatre Manager - which have been audited by external companies as meeting all the rules in effect at the time of the audit.
Feel free to print this setup document. If any part of the network setup cannot be made to comply with the diagram, you will need to address that at a later date to become PCI compliant. Some sample machine requirements are in the table in the picture, or you can view descriptive information on sample computer specs.
(Click to enlarge the pdf)
There are 5 parts to the basic network in the diagram above that are described in more detail in the following sections. The firewall is the glue that connects them all together, yet protects each part from the other (also see firewall rules). These parts are:
![]() |
Theatre Manager implements fully PCI DSS compliant 3DES encrypted passwords per PCI DSS standard 8.5 and this feature cannot be changed or overridden.
In addition, Merchants must use PCI DSS-compliant passwords to access to all system components (i.e. any computer, firewall, router, etc. on the network) and these passwords must be changed from any vendor supplied initial values. However, do not reduce the level of authentication complexity or compliance in these other system components if it will result in PCI non-compliance. |
This means all login passwords must be:
![]() |
Changed all passwords from any vendor default password that might be used for installation per PCI DSS 2.1. For example, you must:
|
![]() |
Each user that has access to any systems in your network must have a unique user id and password per PCI-DSS standard 8.5.8 |
![]() |
Never use the Master User account for daily operation. It should only be used when creating other accounts or for other very specialized needs as directed by Arts Management Systems. |
If your network has 'master' domain server (or open directory on OSX) available that could control password authentication for all machines, please ensure that the security policies on the domain/directory server is set to enforce PCI/DSS passwords and that all machines in the network log in using authentication from the server.
If a domain/open directory server is not available to enforce password settings, then each machine/user must use PCI/DSS compliant passwords.
![]() |
If a user tries more than 6 times to gain access to the system, Theatre Manager automatically resigns the user - which means that they are locked out permanently until manually re-instated per PCI-DSS standard 8.5.13 and 8.5.14 |
We do not recommend a router/firewall without at least DMZ capability if you are doing web sales. However, it is possible to implement full PCI compliance with two routers. Please refer to the Apache Server section for more information.
![]() |
Your firewall need to restrict connections between untrusted networks and any system components in the card holder environment (PCI requirement 1.2).
|
![]() |
This diagram identifies which traffic is required for Theatre Manager to work in the card holder environment per PCI requirement 1.2.1. |
In the example below, we'll refer to all addresses in the office VLAN as 192.168.1.x, addresses in VLAN2 (containing wireless devices) as 192.168.2.x. If you are doing web sales, lets set the DMZ to be 192.168.1.10 (for example). Refer to the SSL Certificate Setup for more detail. The lighter colours red on the diagram represent very restricted rules for specific machines.
The number in the first column refers to the same number on the diagram to give an idea what kind of rules are required for each component. If you combine some services on to the same machine, you will need to aggregate the rules.
For example: #1, the postgres server, only needs port 5432 incoming to that device. You would turn on the personal firewall on the machine so that it only opens that port.
| Item | Machine | Inbound Port Rules | Outbound Port Rules |
| 1 | PostgreSQL server | 5432 from 192.168.1.x |
all to 192.168.1.x 37 to time server |
| 2 | PCCharge | 31419 from 192.168.1.x | 5008 to internet all to 192.168.1.x |
| 3 | Remote Box Office (terminal server) |
xxxx from internet | all to internet |
| 4 | Web Listeners | 5111 from 192.168.1.10 |
80 to 192.168.1.10 25 to SMTP server 37 to time server 53 to internet 80 to maps.googleapis.com/maps/api/geocode (generally 443 to ANY is a good rule instead of specific IP's) 443 to 192.168.1.10 443 to orbital1.paymentech.net (Orbital) 443 to orbital2.paymentech.net (Orbital) 443 to secure.authorize.net (Authorize.net) 443 to api.authorize.net (Authorize.net) 443 to www3.moneris.com (Moneris) 31419 to 192.168.1.x (PCCharge) 5432 to 192.168.1.x ICMP (ping) to www2.artsman.com MX Lookup for email addresses |
| 5 | Ticket Printer | 10001 from 192.168.1.x | all to 192.168.1.x |
| 6 | Workstations | all from 192.168.1.x | 5432 to 192.168.1.x 25 to SMTP server 110 to POP server 37 to time server 53 to internet (MX lookup) 80 to 192.168.1.10 80 to theatremanagerhelp.com 80 to www.artsman.com 80 to www2.artsman.com 80 to maps.googleapis.com/maps/api/geocode 80 to www.google.com/maps/api/staticmap 20,21 to 192.168.1.10 6116 to www2.artsman.com ICMP (ping) to www2.artsman.com MX Lookup for email addresses (generally 443 to ANY is a good rule instead of specific IP's) 443 to 192.168.1.10 443 to orbital1.paymentech.net (Orbital) 443 to orbital2.paymentech.net (Orbital) 443 to secure.authorize.net (Authorize.net) 443 to api.authorize.net (Authorize.net) 443 to www3.moneris.com (Moneris) 31419 to 192.168.1.x (PCCharge) |
| 7 | Apache Server | 80, 443 from internet 80, 443 from 192.168.1.x 20,21 from 192.168.1.x |
5111 to 192.168.1.x 37 to time server |
| 8 | Outside of Firewall | 80 from internet 443 from internet xxxx (terminal services) |
|
| 9 | wireless | all from 192.168.1.1 | all to 192.168.1.1 |
| 10 | VLAN2 (non office computers and wireless ticket scanners) | all from 192.168.1.1 | all to 192.168.1.1 80 to 192.168.1.10 (apache) |
| Port | Meaning | Security Note | ||
| 20,21 | FTP. Only used between the workstation and the apache server to place pictures/jpegs on the Apache server for WYSIWYG e-blasts | TM users will not know the userid and password. It is specified in Company Preferences and cannot be customized by a user. | ||
| 25 | SMTP: outgoing email access for web sales, eblasts and meeting scheduling only. | We recommend that you place a small SMTP server within your network so that TM talks to it and it relays to the internet. This will control outgoing access. | ||
| 37 | Time Server. OSX and Windows machines use this to syncronize clocks. All machines should be able to perform this so that transactions are acurately recorded when the happen. | |||
| 53 | MX lookup. When users and customers enter email addresses into the system, Theatre Manager verifies that their is a mailbox that will accept the domain of the email address - for edit checks. This is done by looking up MX records through DNS services. | This can be turned off inside TM at the expense of data accuracy - if desired | ||
| 80 | Standard HTTP port | only required incoming for Apache server. Recommended outgoing to theatremanager help.com and teamviewer servers. Machines that are web listeners must also be specified in the httpd.conf file to ensure that no outside machine can receive requests set to the Apache server.
|
||
| 110 | Standard POP3 port | TM has a scheduling function that lets users set up calendar event and send the invitations to users, patrons and volunteers. The incoming port is only checked by TM, and only mails with valid outlook or iCal attachements are read. All others are discarded. No user checks this email address. | ||
| 443 | Standard HTTPS port | required for web sales (incomming) and for Paymentech Orbital (outgoing) | ||
| 5008 | Standard port used by PC Charge to talk to any credit card service provider. All comunications are encrypted | only required if using PC Charge | ||
| 5432 | Standard port used to talk to Postgres Database. | It is only used to talk within the LAN. The pg_hba.conf file on the postgres server also specifies which IP addresses can talk to it - otherwise it does not respond. | ||
| 6116 | this is used for a number of purposes. It is the update checking port to look to see if there are newer versions of Theatre Manager. It is used to provide feedback to the routers outside IP address (like whatsmyip.org but to a known DNS). It is used to verify that PC Charge or Orbital has possible internet access and that the system could function properly. | can be confined to talking to www2.artsman.com | ||
| 10001 | Ticket printer port. Workstations send a string of characters to print a ticket. The printer responds with status requests as need be. | no outside machine needs access to a ticket printer. | ||
| 31419 | Standard port used by workstations in the office lan to talk to PC charge | no outside machine should have access to this port | ||
| xxxx | Represents setup of Remote Box Office using terminal services. | a VPN connection between router1 and the remote box office is recommended for security purposes, even though RDC and terminal services establishes secure connections. |
![]() |
The office lan should be set up to isolate computers that may access credit cards from other general purpose machines. These machines should be hardwired to ethernet hubs and routers. Generally, this just means putting it on a different VLAN than the rest of the office to provide maximum cardholder security (PCI requirement 2.1.1) |
For example, if there is an area that provides free wireless in the lobby, or access to the internet for actors in the green room, those access points should be part of the 'Venue Lan' and not part of the 'Office Lan'
![]() |
You should not be able to access the internet from the database server or any machine that contains credit card information. (PCI requirement 1.3.2) |
Ports that should be open are:
Misc Recommendations
![]() |
Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and file servers) (PCI requirement 5.1) |
You will need to provide outgoing https (port 443) access to the following two URL's:
PCCharge™ listens on port 31419 by default. Open this port on the workstation for incoming and allow 5008 for outgoing. This can be changed be configuring both PCCharge™ and the merchant preferences in Theatre Manager.
Normally, in a PC environment, the Postgres and PCCharge™ servers are combined onto one machine.
Multiple web listeners can be set up to talk to apache. If you wish to restrict specific machines to be web listeners, enter the IP addresses of those machines in the Apache configuration.
If desired, you can install anti virus software on this machine. Since it is not used for any other purpose and listens only to the API's from the apache server, you should not need any.
![]() |
Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers) (PCI requirement 5.1) |
Machines accepting Credit Card data (especially with swipes attached)
Any computer where credit card information is entered or that has an attached credit card swipe is effectively a point of sale device and needs to be protected from a particularly nasty form of virus called 'Bots'.
These are especially prevalent on PC's and if a computer were to become infected, this type of virus scans keystrokes at the computer and sends those key strokes to the 'bad guys' outside the network. Preventing this involved closing ports and denying access to the outside world, especially for mail and web browsing.
For this reason, on those computers, you should:
![]() |
Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers) (PCI requirement 5.1) |
Machines that do not accept credit card information
Machines not being used with Theatre Manager (or where there is no entry of credit card numbers), can be allowed internet access.
If those computers are on the same network segment as the machines accepting card numbers then they fall into the scope of a PCI assessment for the venue. This means those machines would need all of the anti-virus and anti-malware software as well as file integrity monitory, log management, access control, etc. just like the machines that accept the cards.
To reduce the scope of the venue's PCI assessment needs, the venue should consider placing those machines (back office or manager machines usually) on a separate network segment with just the necessary ports between them and the cardholder data network open. In this case, follow the previous setup suggestions for port and virus software installation
![]() |
Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers) (PCI requirement 5.1) |
![]() |
Machines in your office that generally do not need access to Theatre Manager need to be in a separate VLAN so that they do not accidentally compromise credit card data. Rules should be put in place so that these VLAN's cannot talk to the servers in the Office VLAN per PCI requirement 1.2.3 |
It may be a good practice to have one or more VLANs beside the primary office network, especially if you have wireless access points, public WI-FI in your lobby, green room access for Actors, etc. Separating those kinds of users form the office lan is beneficial from a security and bandwidth management point of view. Network segments not dealing with cardholder information may be unprotected, use WEP or WPA.
![]() |
However, if you do require that some computers access cardholder data over a wireless network, you must use strong encryption technology for authentication and transmission of data such as hidden SSID, specified MAC addresses, and WPA2 or better on a separate VLAN than other wireless access points and change vendor supplied passwords per PCI requirement 2.1.1.
You must never transmit card information over a network with WEP encryption per PCI requirement 4.1.1. |
The only difference is that you can use the IP address of the Apache server directly (e.g. 192.168.1.x) in the scanner, or you can use local DNS services to point to the Apache server within the network. It is generally easier to use the direct IP address unless you have access to the technical resources to set up DNS for this purpose.
Since Apache is on this machine, it should auto start as a service upon reboot. This means nobody need login at all. However, configure the screen saver to require a password after it is activated.
This machine is only responding to requests from the internet via Apache, it is not actively accessing anything on the internet using a browser or reading email - so the risk if is acquiring viruses is very minimal.
If you put a virus scanner on it, set it to scan the hard drive once a day, preferably early morning or at a time of day when online sales is expected to be at its minimum. Some antivirsus software applications are CPU intensive and have the potential to severely slow down the Apache response time to web requests.
The best setup conditions would be:
![]() |
Note that card holder data should never be stored or placed on the Apache server for any reason. Theatre Manager does not require it. (PCI requirement 1.3.7) |
![]() |
Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers) (PCI requirement 5.1) |
PCI compliance requires some additions to your policy manuals, some of which are described below and relate to safeguarding your network and the credit card information. We recommend making these additions immediately.
![]() |
Refer to Section 12 in the PCI DSS implementation guide for complete information |
| Policy | Description |
| 1. | Credit Card information must not be stored on any machine that is in the DMZ.
This generally means laptops that connect to the network wirelessly should be examined for files that contain card information and that information must be deleted. |
| 2. | Do not transport credit card information outside the secure firewall without:
|
| 3. | Never email a credit card number to anyone. |
| 4. | Never read back an entire credit card to a patron if they call in asking for one. Always have the patron tell you the card and confirm it only if it right. You can confirm a card number that the patron just told you in entirety. |
Access to the terminal server from outside the main network should be include VPN or packet encrypton.
If the remote box office solution permits the feature, you should also set it up so that only specific applications can be launched and the user cannot get to the Desktop. For example, Citrix provides a web interface under is ISA services that allows you to only permit Theatre Manager to run. With Terminal Server, you can also force it to start Theatre Manager automatically.
|
Always disable outgoing web access on citrix or terminal server so that people cannot browse the internet (this will prevent all viruses). |
![]() |
Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers) (PCI requirement 5.1) |
In most cases, the best way to do remote box office is to set up a Terminal Services server inside your network and provide a VPN solution from the remote site to the router.
An inexpensive Linksys VPN router will provide adequate router to router VPN services inexpensively - or will provide remote VPN software for computer to router VPN. More expensive routers like Cisco have VPN software that accompanies the router as well.
In all cases, remote box office or work at home should be set up using a VPN connection.
Note: if installing on terminal server 2003, you may need to switch it between 'execute' and 'install' mode to actually install Theatre Manager.
|
If you are using remote box office and ticket scanning for access control at the same venue, it is advisable to set up the wireless access point to talk to the VPN router and send all data through the VPN tunnel as a point of extra security. |
The setup of the wireless access point should be:
The setup and functioning of the symbol MC55 wireless device is described in a separate document.
When you need to enter in the IP address, you can use tickets.yourvenue.org/TheateManager/1 if you have set up a DNS or you can use the static IP address of the outside router.
You can also specify port 80 or 443 (or some other port if you wish to do address redirection within the router for additional security).
|
Even if you are scanning tickets at you local venue, it is often a simple matter of setting up a small hub in front of your main router so that the access points are connected to it - and they would be outside the firewall for security. |
![]() |
In all cases of remote access for box office, you should implement either VPN tunnel and/or SSH access - where the communication and session has strong encryption or is a private connection per PCI DSS 4.1 |
There may be additional setup consideration as described in the following sections base on the software you use. Your IT person should ensure that whichever software is used, that it employs VPN or SSH.
![]() |
PCI compliance requires that remote access have a user id and password, and an additional authentication factor that includes, but is not limited to items such as a smart card, token, PIN, Biometrics, VPN. |
![]() |
For people with remote access, you must establish passwords according to PCI DSS requirements 8.1, 8.2, 8.4 and ann requirements of all sections of 8.5. In other words, the requirements for remote access passwords and authentication are exactly the same as for access to your office lan. |
![]() |
If you are using remote access, you need to set up terminal server to use high security access for Remote Desktop and it should be set to disconnect or lock the terminal after a period of inactivity. (PCI requirement 12.3) |
When connecting from any workstation to 2003/2008 Server, the server defaults to high encryption. It is good practice to verify that the setting has not been lowered.
| Step | Purpose | Installation instructions or link |
| 1. | Verify Terminal Server settings | The following links detail the security settings in Windows Server 2003. Server 2003 defaults to High encryption, but it is a good practice to make sure it hasn't been lowered accidentally. |
| 2. | Verify RDP settings | RDP should be set to always prompt for a password. |
When connecting from any workstation to 2000 server, the server setting workstation is allowed to specify the security level, and unfortunately, it defaults to the lowest security level. You need to make some changes to the settings to connect at the high security level.
| Step | Purpose | Installation instructions or link |
| 1. | Set up Terminal Server Settings | The Encryption Levels settings in Terminal Server should be set to High for the Remote Desktop Protocol. Refer to the technote on the microsoft web site for the proper procedure. |
| 2. | Verify RDP settings | RDP should be set to always prompt for a password. |
![]() |
Theatre Manager uses TeamViewer for remote support. This is designed to never be active, unless the user contacts Arts Management and permits the technical staff to have access to their machine for the purpose of diagnosing a problem on a one time basis. It is to be disconnected after use per PCI requirement 12.3.9. Theatre Manager never requires permanent access to your networks for any reason. |
The process for actual access to the remote machine is as follows:
TeamViewer uses SSH for authentication and brokering of session keys. It communicates with the master cluster is through DNS names, which delegates the brokering of the session to the TeamViewer servers. Connection to the routing server and KeepAlive server is done directly via IP addresses.
The servers are spread across the globe and located at large data centers, their IP addresses are not organized in common subnets or IP ranges. Teamviewer continuously top scales the server network as the number of TeamViewer users grows, so it is not possible to have a fixed set of IP addresses, because this list would very soon be outdated.
Communication is done to URL's of the format:
This is where your customers will be.
A customer has zero configuration to do on their machines, other than to allow cookies from your site if they cannot browse the web pages. The Theatre Manager Web Listener will alert them to turn on cookies as it detect people trying to move through pages without cookies enabled.
![]() |
PCI DSS compliance sections 10.2 and 10.3 require that Theatre Manager maintain audit logs for certain system events. These primarily deal with who has seen or could have seen credit card information.
The transaction logs in Theatre Manager deal with all these requirements because Theatre Manager has always maintained and 'audit log' of certain system events that tracks the events required in PCI section 10.2 and the a minimum of the data elements in PCI section 10.3. |
The following screen shot is a sample of an audit log that is contained within the transaction records in Theatre Manager.
All financial and access audit log transactions are kept forever. Specifically transactions like Login, Logout, Invalid Access, and Viewing Complete Card Data are kept in perpetuity. Transaction types are 'coded' and 'dated' for easy finding and sorting.
|
there are some non-fiancial transactions like 'ticket unprint' which are kept a minimum of 1 year or longer depending on settings. These do not affect finance or PCI compliance so retention is optional. |
| PCI Std. | Requirement | Theatre Manager Implementation | ||
| 10.2 | Implement automated audit trails for all system components to reconstruct the following events: | |||
| 10.2.1 | All individual accesses to cardholder data | Theatre Manager creates an 'AC' transaction to track whenever a user sees the entire credit card number. By default, Theatre Manager displays masked card numbers in all windows and reports. Only in specific places will Theatre Manager display card information to those who have specific authorization to see cards. Therefore, you should expect to see very little information in the audit log if you minimize who has access to see full card data.
None of these transactions can be purged. |
||
| 10.2.2 | All actions taken by any individual with root or administrative privileges | An administrative user is subject to the same rigorous requirements as all other users. | ||
| 10.2.3 | Access to all audit trails | Theatre Manager does not track who views audit trails because they cannot be changed, manipulated or altered by the user in any way. We believe that when users know this information is tracked for PCI compliance, it acts as an additional deterrent. None of the logs ever display sensitive data. | ||
| 10.2.4 | Invalid logical access attempts | Theatre Manager tracks who access's Theatre Manager and logs in or out via the 'ALI' and 'ALO' transactions.
'ALX' transactions track invalid login attempts (after 3 mistyped passwords), or when the user account is locked out. These transactions cannot be purged. |
||
| 10.2.5 | Use of identification and authentication mechanisms | Theatre Manager uses login and authentication mechanisms. All users of the application must log in. | ||
| 10.2.6 | Initialization of the audit logs | The audit logs can never be 'initialized' by the user, nor can be they be cleared except under programatic control. The minimum retention time is 365 days for audit transactions with the default being forever. Payment logs indicating who took the actual payment are retained forever and cannot be deleted. | ||
| 10.2.7 | Creation and deletion of system-level objects | |||
| 10.3 | Record at least the following audit trail entries for all system components for each event: | |||
| 10.3.1 | User identification | yes - see log example | td>||
| 10.3.2 | Type of event | yes - see log example | ||
| 10.3.3 | Date and time | yes - see log example | ||
| 10.3.4 | Success or failure indication | yes - see log example | ||
| 10.3.5 | Origination of event | yes - see log example | ||
| 10.3.6 | Identity or name of affected data, system component, or resource | yes - see log example | ||
Please use these as ticklers to yourself.
![]() |
If card data is to be transmitted over a public network (i.e. outside your firewall), it must be sent using secure encryption technology like IPSEC, VPN or via SSL/TLS per PCI DSS 4.1. |
![]() |
Do not send any credit card data 'in the clear' such as pasting a card number into an email, or into an IM per PCI DSS 4.2 unless you are using secure encryption with these messaging technologies. Do not encourage customers to send cards, cvv2, name, expiry or any other such data to you via the same technologies.
|
![]() |
If you are upgrading from a prior system that might have had unencrypted credit card information, you must throw that data into the trash and secure erase it with a tool like ERASER (free) on the PC or do a file->Secure erase on the Mac. |
The server only needs to be set up on one machine where you want the database to reside. Theatre Manager can be set up on as many machines as you wish.
|
Do not install virus software on the Postgres Server except under very controlled circumstances and never allow virus scanner to scan the actual postgres database directories. |
![]() |
When downloading any update for Theatre Manager, please make sure your personal firewall is turned on (PCI requirement 1.4) |
The server needs to be set up on one machine and the application can be set up on as many machines as you wish.
Follow these steps if you are using the TheatreManager TM PostGresSetup installer program and you may want to bookmark this page in your browser in case you want to refer to these installation steps. If you are only installing a demo, refer to the last column for required steps.
| task | Description | Full Install | Demo |
| 1 | If the server is OSX-LION (10.7.0 or later) and there are two drives in the computer (you will probably see two disk icons on the desktop or look in disk utilities), we strongly recommend STRIPING the two drives due to a very significant performance improvement. If you have this situation (very common in Mac Mini Servers), refer to this page to prepare the hardware and reinstall the operating system as Lion is not shipped with the drives striped.
The steps are similar for those using OSX 10.6.x or earlier - but you will have install DVD which makes is a bit easier. The process is similar. |
yes | no |
| 2 | download the PostGres installer for Mac | yes | yes |
| 3 | the installation of the PostGres SQL server | yes | yes |
| 4 | installing the demo database and the main TheatreManager User | optional | yes |
| 5 | configuration of the server parameters for maximizing performance in a production database | yes | no |
| 6 | creating a daily backup job in using cronnix to run the backup | yes | no |
| 7 | Turn off energy saving, airport and other energy saving features | yes | no |
|
The steps outlined are similar if you have a Mac Mini or Mac Pro running OSX 10.6.x or earlier. You will have and install DVD and can do most of the steps without connecting to the internet. |
The general process to prepare such as machine for optimal performance is:
The steps have a degree of technical complexity and assume you are able to interpret and adapt to variations in the process yourself.
Since Lion does not come with any install disks, you will need to follow a special procedure to stripe the drives on a lion servers as follows:
At the and of the TM PostGres file installation phase, the actual Postgres install process will begin immediately. If you cancel the setup of PostGres, you can always start it again by repeating the process from the start.
| 1. | Double click on the TMPostgresSetup application. You will be asked to authenticate the installation by OS-X. Please type the appropriate user id and password.
|
| 2. |
Click 'Continue' on the splash screen
|
| 3. |
Read the licence agreement and click 'Continue' to accept it.
|
| 4. | Click 'Agree' on this screen
|
| 5. | Click 'Install' on this screen.
|
| 5. | Click 'Install' on this screen.
|
| 6. | You will see the installer complete the work.
|
| 7. | When it is done, you will see a notice that postgres was installed. Click 'Continue'
|
| 8. | Click 'Quit' on this screen and restart the computer.
|
In most circumstances, you can skips this and the remainder of the steps if you are only installing a demo. If you are not, you will need to proceed to steps 3 and 4.
The database server needs a specific user called TheatreManager with specific privileges that will be assigned as the owner of each database. We also want to import a demo database. This step assumes that you have installed things into the /Users/Shared directory. If you did not, then you will need to edit the script and do this step manually
| 1. | Go to /Users/Shared directory. You should see some files and folders with names that look like below.
|
| 2. | Start terminal and change the user to 'postgres' by typing: su - postgres Press RETURN and then type the postgres user's password (password will not display anything)
|
| 3. | Drag the script '/Users/Shared/CreateDemoDB.sql onto the terminal window. This shortcut saves typing anything. Click into the terminal window and then press RETURN to start the command. If it does not run, then possible issues are:
|
| 4. | The script will run and load up the TheatreManagerDemo database. You can modify this script to load up a customer database if necessary by editing it in BBedit or in textedit (make sure to save it as text if you use textedit - its preference, unfortunately, is to save as an rtf document). Note, any WARNING messages from the TheatreManagerDemo database creation can be ignored. These warnings are normal.
|
The general steps are:
This step is optional to do and is done for you automatically when you run the Theatre Manager postgres database installer
This step is done automatically for you if you have used the Theatre Manager postgres database installer and you have more than 2 gigs of ram on the sever
In order for clients to connect to the server, their IP address must be in the allowed list of users. The two common authentication methods that you will see being used for Theatre Manager clients are MD5 and trust.
| 1. |
The first changes to make involve the pg_hba.conf file and the postgres.conf file. To do so, you'll need to use VI (a text editor) and be the postgres user in terminal. To do this, start terminal and type
su - postgres enter the password
|
| 2. | Go to the postgres data directory by typing
cd data
|
| 3. | Edit the postgres pg_hba.conf file that contains the addresses to listen on. Type
VI pg_hba.conf You should see a page of information. If you do not, then type 'Shift Q' and then just a 'q' - after which you can start the process over. If you see the list of text similar to the right, then: Use the down arrow on your keyboard to go to the very end of the file
|
| 4. |
When you are at the end of the file, use the up arrow on your keyboard so that you are right after the first line in the IPv4 settings there it says 'host all all 127.0.0.1/32 trust'. In the example the cursor is on the '#' on the line after. type the
key and the message at the bottom will change to Insert. |
| 5. |
Edit the pg_hba.conf so that its final settings are similar to the window on the right. Type directly into Terminal so the data looks like the window above. Use the delete key to get rid of characters. You will likely end up typing the following lines where the first one is your subnet. This is the most typical example we've seen at venues NOTE: For the 127.0.0.1/32 option, edit the handshaking to be TRUST at the end of the line to allow backups to run unaided. NOTE: If your machine uses IPv6 (the new internet IP setting standard), you may also need to set ::1/128 to be TRUST instead of md5. If so, edit that line to look like:
NOTE: If you are running version 9.0 or higher of postgres in a Mac environment the local all all line should be set to TRUST. NOTE: You may also need to edit the local all all line from md5 to TRUST. This can be determined if the backup script will not run without a password after changing the settings above for 127.0.0.1 and ::1/128. The line you added (or need to add) are for:
At the end of the subnet, the /24 refers to a complete subnet when you want any machine on the subnet to access the database. This is what is used most often. The /32 refers to a particular machine. If you use this option, you will need to provide the exact computer IP that you want to allow to access the database. |
| 6. |
At the end, type, in this order: hit the '' key (the insert mode will dissappear) (the window will show the 'Entering Ex mode' message) and the window will clear.
Reference for settings in the pg hba.conf file www.postgresql.org/docs/9.0/interactive/auth-pg-hba-conf.html |
| 1. |
You will need to start by changing to the postgres user in Terminal. To do this, start terminal and type
su - postgres enter the password
|
||||||||||||||||
| 2. | Go to the postgres data directory by typing
cd data
|
||||||||||||||||
| 3. |
This will also use VI to edit it. Type when the list appears, type to go into insert mode and use the up and down arrows to find the options below
Find and edit the parameters in the list below and change them to the suggested values, if they are not already set to that value.
For any setting that is about disk space or memory, you can type 1GB, 1000MB, 1000000KB and they are the equivalent. Do not leave a space between the number and the memory amount at the GB, MB or KB otherwise postgres will not start. |
||||||||||||||||
| 4. |
Reference for postgres.conf file parameters http://www.postgresql.org/docs/9.0/interactive/runtime-config.html |
||||||||||||||||
| 5. | Once the changes are made, type, in this order:
hit the '' key (the insert mode will dissappear) (the window will show the 'Entering EX mode' message) and the window will clear and you will be back at terminal |
Otherwise, this step is not required under most circumstances.
| 1. | Start Terminal and navigate to the home directory for postgres user.
Type: cd /Library/PostgreSQL/9.1 |
| 2. | Next, lets update the profile for terminal to that it makes life easier in postgres from this point on. Type
it will open with an empty window as below.
Just like when using VI for the other two files, type: to put you in insert mode |
| 3. |
Type the two lines into the file exactly as shown. When done, type, in this order: hit the '' key (the insert mode will dissappear) (the window will show the 'Entering Ex mode' message) and the window will clear and you will be back at terminal. The next time you start terminal under the postgres user account, you will have access to the postgres commands and data directory in a more convenient fashion. |
If you used the Theatre Manager postgres installer, it will detect if you have more than 2 gigs of ram in your machine and automatically insert these into the /etc/sysctl.conf file for you. After installing postgres the first time, simply reboot the server - these settings will have been done for you and you need not continue with the steps below.
BEFORE STARTING: Ensure you are in terminal at your own user, not postgres. This is a fairly technical topic and the reference: http://www.postgresql.org/docs/9.0/interactive/kernel-resources.html
| 1. |
Open terminal again and type: su - [Your UserName] Type vi /etc/sysctl.confType I to insert data Add the lines: kern.sysv.shmmax=2202009600kern.sysv.shmmin=1 kern.sysv.shmmni=64 kern.sysv.shmseg=16 kern.sysv.semmns=130 kern.sysv.shmall=550502400 kern.sysv.maxproc=2048 kern.maxprocperuid=512 These settings reflect the maximum size of a shared buffer. These settings assume you are running at least 2GB of RAM. If you have less RAM, these settings may need to be altered. shmmax is the key setting; it is in bytes. If the machine has more memory to use, then this could be increased as well. shmall is the shmmax setting divided by 4. |
Hit the Esc key
Hit Shift Q
Type wq
Hit Enter
Restart OS X after doing this. This is required to apply the changes.
There is a sample of this file in /users/Shared/ from the install. If your machine has 2GB of RAM or more, you could move it to the right folder instead by:
Restart OS X after doing this. This is required to apply the changes.
However, it is perfectly ok to set up 2 or more daily backups while Theatre Manager is running. You may wish to do this on a high volume site and pick times like 8:00am, 1:30pm and 8:00pm, for example. Backups can run while Theatre Manager is being used.
You can also do a manual backup at any time by going into Terminal and running the 'backupTM.php' file mentioned in this section, even if Theatre Manager is running. You would do this using terminal on the server by typing
php /Users/Shared/backupTM.php
based on what you had already done to configure the script using the instructions below.
This backup process only exports data from the database and creates a compressed backup file. You will need to take those backups and copy them to another machine and/or establish a backup rotation and take some offsite.
| 1. | If you used the installer to place files into the correct location, you can skip to Step 2 in this section. If you did not, then you will need a copy of the backup script files and then:
|
| 2. | If the files are in the correct place because they were installed by the installer, then we will need to edit the backupTM.php file. Note, if you have multiple databases to backup, make a copy of this file for each database you want to backup and edit accordingly.
|
| 1. |
Test the batch file by starting up terminal and typing the highlighted command
|
| 1. | Create a timed backup for the database by going to the /applications directory and starting a program called CronniX. A copy was installed by the PostGres Setup program. CronniX is shareware and can be found at www.abstracture.de/projects-en/cronnix
Only do this on the machine that has the database server on it and make sure you are logged on as the administrator. |
| 2. | Double click on the 'CronniX.app' icon (it may or may not have .app at the end). This will start the CronniX task Scheduler. On a side note, Cronnix is an interface to the Unix CRON facility. CRON has been around for a long time and is one of the task scheduling tools that is built into the unix operating system. You don't have to worry if it is on your system.... it just is.
Click the New icon on the upper left. It will open a new window with a sample script at the bottom that says: echo "Happy New Year!" Replace this with the same command used to start a backup in the preceding section. php /Users/Shared/backupTM.php Click on the expert tab and make the settings in the upper half of the screen as per the example. These settings adjust your backup schedule. For example if you want a daily 2am and 2pm backup:
This will effectively schedule two per day backup of your database and is the recommended backup schedule to setup. Entries for any of the items can be like:
Note: you can schedule backupTM to run as many times as you want during the day by changing the parameters of the one CRON job, or by creating more jobs. Once or twice per day is normally enough but you may feel that more times is better for your backup requirements on busy days. |
These steps are valid if you are using version 9 of Theatre Manager or later.
Download the latest postgres installer from the Artsman web site. Once you have it, make sure you have done the following steps:
Remember, do not attempt to try this unless you just made a backup of your database. Preferably, you should also have restored that backup on another machine for safety, logged into it using Theatre Manager to prove that you can restore a backup and that it has 100% integrity.
If you have postgres 9.0.x (or older), the upgrade process involves some extra steps and can be done by Arts Management Support team if you are not comfortable following the steps below. These are:
com.edb.launchd.postgresql-8.3.plist
com.edb.launchd.postgresql-8.4.plist
com.edb.launchd.postgresql-9.0.plist
Please delete those file and restart your machine. If you uninstalled the older servers properly, they should not be there. Do not delete the file corresponding to the current version of the server.
Make sure that postgres 9.1 is still running
The following settings should be made on all servers (postgres, apache and web listeners) that are installed on Macintosh.
| 1 | Make sure to turn off all energy saving options such as prevent hard disk sleep, do not allow the CPU to go into low processor mode, etc. |
| 2 | Make sure to turn airport OFF if the Mac comes with it. Airport will cause the mac to temporarily freeze while it looks for a network to connect to - and will lock out sales while it does that.
This is done by opening the control panel, clicking on the airport interface and then clicking on the 'gear' at the bottom to select the option 'make service inactive'. If you do this, the status will go from 'off' to 'inactive'
|
| 3 | Make sure to physically plug in a Monitor to the Mac -or- connect a KVM switch into it that is powered up. If you disconnect a monitor from the Mac, it will stop working as a listener and web sales appear frozen. (it is an OSX thing) |
| 4 | Turn off Spotlight Indexing on Snow Leopard using sudo mdutil -a -i off On Lion, use the following command sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.metadata.mds.plist This will prevent the operating system doing un-neccessary work while serving web pages. you will know if Spotlight is running on a server if you see the 'mds' application running. It can take a lot of CPU. |
| 5 | Do not use the postgres server for Time Machine backups - use the backup script and move the backups to another machine |
The server needs to be set up on one machine and the application can be set up on as many machines as you wish.
Follow these steps if you are using the TheatreManager TM PostGresSetup installer program and you may want to bookmark this page in your browser in case you want to refer to these installation steps. If you are only installing a demo, refer to the last column for required steps.
| task | Description | Full Install | Demo |
| 1 | download the PostGres installer for Windows | yes | yes |
| 2 | the installation of the PostGreSQL server. Please make sure to read any caveats for the version of Windows you are using. | yes | yes |
| 3 | installing the demo database and the main Theatre Manager User | optional | |
| 4 | configuration of the server parameters for maximizing performance in a production database | yes | |
| 5 | creating a daily backup job in Windows Task Scheduler to run the backup | yes | |
| 6 | Considerations for installing virus protection on the Postgresql server - please do not include the posrgres data folder. | yes | |
| 7 | Turn off Microsoft disk indexing on the volume that the database is running on. | yes |
| Windows Small Business Server | For Windows Small Business Server, you MUST turn off 'disk quota' for all users prior to installing PostGres (and leave it off). Otherwise you may run out of space for the installer and any databases that get installed.
|
| VISTA or Windows 7 | For VISTA/Windows 7, you may need to turn off UAC (user access control) because it is acting as a server. You can run Theatre Manager on other workstations with UAC on. To turn UAC off for a server:
|
| DOMAIN CONTROLLER | If you want to run postgres on server that is acting as a DOMAIN CONTROLLER, you will need to:
|
| Microsoft Windows Server 2008 | If you are running Microsoft Windows Server 2008, the following steps should be followed when running the installation programs:
|
| XP, 2000, or 2003 | There are no known caveats with XP, 2000. With Windows 2003 server, you may need to refer to the the Microsoft Windows Server 2008 - depending on how your 2003 server is configured. |
When you run the installer for the database, accept all the defaults.
| Click Ok |
Right click on the TMPostgresSetup.exe application and use 'Run As' to begin the install. Select a LOCAL administrator as the user ID to use for the install. If a checkbox that implies "Protect My Computer" or "Run with Restrictions" is available and enabled, uncheck the box to allow the installer to run with full install privileges.
|
| Click next | ![]() |
| Click next | ![]() |
| Click next | ![]() |
| Click next | This will put the actual installer files into a C:\BoxOffice directory along with all the support files needed for the rest of the steps. Note: If you have multiple drives, you may want to install the database server on a larger data drive like D:\BoxOffice
|
| Click next | ![]() |
| Click Yes | At the and of the TM PostGres installer, you will be asked if you want to actually install the PostGreSQL database in the dialog below.
If you say yes, follow the instructions to install postgres on the next section. Alternatively, you can do this later manually by:
![]() |
| Click next | ![]() |
| Click Next |
NOTE: if you wish to install PostGres on another drive instead of the C: drive, click the Browse button and select another drive.
NOTE: please be aware that the standard install location depends on 32 or 64 bit version of the operating system
|
| Click Next |
Accept the default for the ' Account Password' for the postgres user. However, if this is a demo. In that case, please pick a user password that you remember - we suggest 'Master'. NOTE: For a purchased version of Theatre Manager, this will be set up for you by your trainer who will use a specific AMS password for this server that should not be changed. |
| Click Next |
Leave the Port Number as 5432 (if you change the standard port, you will also have to change it in Theatre Manager login window) |
| Click Next |
Leave both these settings as shown. |
| Click Next | ![]() |
| Click Next | You will need to wait for a bit while the database server is installed
|
| Click Finish | Important: Uncheck the 'Launch Stackbuilder at Exit' setting. There are no additional modules to install into your database at this time. At this time, the database should have installed successfully and should be runnning. ![]() |
| Click Yes | ![]() |
| Wait | Wait while a DOS window pops up and shows the progress of the demo database being imported. Depending on the performance and RAM in your machine, this could take a few minutes to finish.
|
| When the DOS window closes, the database server is installed, and the TheatreManagerDemo database is imported. |
After the database server is installed, we need to create a specific user called TheatreManager and give them privileges. We also want to import a demo database. This step assumes that you have installed things into the C: drive into a directory called C:\BoxOffice. If you did not, then you will need to edit the bat files and do this step manually
| 1. | go to C:\BoxOffice directory. You should see some files and folders with names that look like below |
| 2. | Double click on the 'ImportDemo' bat file that is highlighted above. This will start a DOS prompt and start the bat file running. Note: if the server is 64 bit, then you will need to change the ImportDemo.bat' file to refer to C:\Program Files (x86). If you altered the install directory, you will need to change the path name to point to the location that Postgres was installed in. Normally, this is just changing the drive letter. |
| 3. | You will be asked for the password in order to create the 'TheatreManager' user. Type the password you used for the installation of the database in the preceding section. If this is a demo database install, this might have been 'master' that you used when installing the server. Note: the password will not be echoed to you and you will not see the cursor move. There is no visual feedback that even a character was typed. You'll just have to get it right. If any of the steps are not right, you can start at the top of this step at any time. |
| 4. | You will be asked for the password in order to create a 'TheatreManagerDemo' database. Type the same password used above and elsewhere in the install instructions
|
| 5. | You will be asked again for the password in order to import data into the TheatreManagerDemo database. Type the same password again and you will see a lot of lines displayed to you after that point as the demo database is imported. |
| 1. | Start the PG Admin III database management application. This is found using Start Menu->Programs->PostGresSQL-> PG Admin III.
If you get any helpful tips, click 'close' to get rid of them. |
||||||||||||||||||||||||||
| 2. | Click on the server for this machine and login. Use the password you created when installing the database server
|
||||||||||||||||||||||||||
| 3. | Click on the Databases line to begin the next step of configuration. | ||||||||||||||||||||||||||
| 4. | edit the pg_hba.conf file.
|
||||||||||||||||||||||||||
| 5. | Edit the postgesql.conf file
|
However, it is perfectly ok to repeat the steps below and set up 2 or more backups daily while Theatre Manager is running. You may wish to do this on a high volume site and pick times like 8:00am, 1:30pm and 8:00 pm, for example. Backups can run while Theatre Manager is being used.
You can also do a manual backup at any time by double clicking on the 'BackupTM.bat' file mentioned in this section - again, even if Theatre Manager is running. It is generally found in the C:\BoxOffice folder, although it may be on another drive on the database server. The location of this file is where you placed it using the instructions on the rest of this page.
This backup process only exports data from the database and creates a compressed backup file. You will need to take those backups and copy them to another machine and/or establish a backup rotation and take some offsite.
| 1. | If you used the installer to place files into the correct location, you can skip to step 2 in this section. If you did not, then you will need a copy of two files and then:
|
||||||||
| 2. | If the files are in the correct place, then we will need to edit the BackupTM.bat file. Note, if you have multiple databases to backup, make a one copy of this file for each database you want to backup and edit accordingly.
|
||||||||
| 3. | test the batch file by double clicking on the TMBackup.bat to see that it runs. You may be asked for a password. if so, enter it and you should see a bunch of feedback as the database is backed up. If you do have to enter a password, refer to #4 (below) When done and the DOS window closes, go to the C:\BoxOffice\Backups directory and see if there is a recent backup for your database. Note that there shold be some size to the database backup.. is should not be zero bytes. In this sample, we have the original demo and a backup made on 20070913 at 12:40:04 in the afternoon. There will be a new file here each time the backup is run.
|
||||||||
| 4 | If you entered a password to make the backups run, then you need to tell the postgres to allow 'Trust' permissions for the local machine so that backups will run un-aided. On XP, you may just need to provide trust access to 127.0.0.1/32. On Vista, you may need to provide 'trust' access to ::1/128 as well. Refer to the section on editing the pg_hba.conf. file |
| 1. | Create a timed backup for the database by going to Start->Settings->Control Panels->Scheduled Tasks. Only do this on the machine that has the database server on it. If you are using vista or do not have a 'classic' view of the task scheduler, then you may wish to change the control panel view to 'classic' mode. Somehow, this just seems easier to find things.
|
||||||||||||||||||
| 2. | Double click on the Scheduled Task icon to begin the setup process
|
|
you can schedule backupTM to run as many times as you want during the day by creating more jobs. |
These steps are valid if you are using version 9 of Theatre Manager or later.
Download the latest postgres installer from the Artsman web site. Once you have it, make sure you have done the following steps:
Remember, do not attempt to try this unless you just made a backup of your database. Preferably, you should also have restored that backup on another machine for safety, logged into it using Theatre Manager to prove that you can restore a backup and that it has 100% integrity.
If you have postgres 9.0.5 (or any earlier version), the upgrade process involves some extra steps and can be done by Arts Management Support team if you are not comfortable following the steps below. These are:
C:\Program Files\PostgreSQL
Leaving any of those on will affect performance of the server for the database
As of Oct, 2010, the current minimum acceptable version of Postgres is 8.4.4 (or later). Theatre Manager has been tested with version 9.0 and works with the bytea_encoding set to escape (see parameters in step 4).
The server needs to be set up on one machine and the application can be set up on as many machines as you wish.
Follow these steps and you may want to bookmark this page in your browser in case you want to refer to these installation steps. If you are only installing a demo, refer to the last column for required steps.
| task | Description | Full Install | Demo |
| 1 | download the PostGres installer for Linux from Postgresql.org | yes | yes |
| 2 | the installation of the PostGres SQL server | yes | yes |
| 3 | installing the demo database and the main TheatreManager User | optional | yes |
| 4 | configuration of the server parameters for maximizing performance in a production database | yes | |
| 5 | creating a daily backup job in using cronnix to run the backup | yes |
| 1. | Install the PostgreSQL application. |
The database server needs a specific user called TheatreManager with specific privileges that will be assigned as the owner of each database. We also want to import a demo database. This step assumes that you have installed things into the /Users/Shared directory. If you did not, then you will need to edit the script and do this step manually
| 1. | Go to /Users/Shared directory. You should see some files and folders with names that look like below.
|
| 2. | Start terminal and change the user to 'postgres' by typing: su - postgres Press RETURN and then type the postgres user's password (password will not display anything)
|
| 3. | Drag the script '/Users/Shared/CreateDemoDB.sql onto the terminal window. This shortcut saves typing anything. Click into the terminal window and then press RETURN to start the command. If it does not run, then possible issues are:
|
| 4. | The script will run and load up the TheatreManagerDemo database. You can modify this script to load up a customer database if necessary by editing it in BBedit or in textedit (make sure to save it as text if you use textedit - its preference, unfortunately, is to save as an rtf document). Note, any WARNING messages from the TheatreManagerDemo database creation can be ignored. These warnings are normal.
|
The install instructions are part of this section and require a link to the installer to be provided from Arts Management Systems.
If you already have Theatre Manager, please refer to the link to find out how to get the latest updater.
In either case, once you have the installer or the updater, you can follow the instructions for Macintosh or Windows.
![]() |
If you are upgrading the database from version 7 or 8, you simply run the latest installer. If appropriate, this will automatically generate a random new PCI seed key and re-encrypt credit cards using that key (unless they have been previously shredded). In the process, this destroys any previous crypto keys per PCI DSS standard 3.6.
Refer to re-encrypting cards if you wish to do this manually. |
Upgrading from version 6 requires upgrading the database to version 7 and then following all remaining instructions. Our PABP 1.4 certification covers this process for the few remaining venues.
![]() |
Theatre Manager has never stored CVV2, Track II or any other non PCI compliant information so removal is not necessary per PCI DSS standard 3.3. Version 8 was certified PABP 1.4 compliant. This audit provided verifiability that there was no CVV2 data. Upgrades to versions beyond version 8 will not have this data. |
| 1. | Download the Theatre Manager Mac installer if you have not done so. This link is supplied upon request.
|
||
| 2. | Run the TMSetup.app program and respond to all prompts as follows. Enter the user id and password of the administrator to authenticate the installer.
Click continue
Click continue
Click continue and read the licence agreement
Click 'Agree' to accept the agreement and continue
Click install
The installer will begin putting Theatre Manager into the 'Applications' folder.
Click Quit
|
||
| 3. |
When the installation finishes, you will need to replace the serial.txt file in the Theatre Manager program files.
|
||
| 4. | After installation, look for Theatre Manager link on the desktop and double click on it to start it up. There will also be a file called TMPreview.pdf on the desktop that illustrates some key features of TM. | ||
| 5. | If you get asked to find a database, enter the IP address 127.0.0.1 below and click search. Normally, you should not need to do this as the Demo database is always assumed to be on the local machine.
If you cannot connect to the database, check the following settings:
|
||
| 6. | If you are running a demonstration copy of the Theatre Manager application, you will see a first time setup screen asking you for your company information. All fields except the second line of address and the web site are mandatory. After you put this in the first time, you will not see it again.
These fields are used during the demo to show how Theatre Manager verifies information for you. For example, the city, state and country you enter becomes the default country for new patrons that you may add to the database. The area code for the phone number fields becomes the default for patron entry, etc. Notice how Theatre Manager converts what ever you type into the proper case as it tries to assist in data entry.
|
||
| 7. | Then, if you are able to connect to the database and enter the company information, then you will see the login window below. The password for any of the users in the demo is 'master' (without the single quotes).
|
||
| 8. | In a production environment, once connected to the database in step 5, you can run this the TMSetup file on any other machine in the network. After changing the pg_hba.conf file, and editing the serial.txt file, you should be able to connect to the database.
|
Note: if you are installing on 2003 Terminal Server, you may need to switch the server from 'execute' mode to 'install' mode before using the TMSetup.exe program. After installing, you may need to switch back to 'execute' mode. (This does not apply to any other version of Windows that we know of).
| 1. | Download the TheatreManager PC installer if you have not done so. This link is supplied upon request
|
||
| 2. | Run the TMSetup.exe program and respond to all prompts as follows. Right click on the TMSetup.exe application and use 'Run As' to begin the install. Select an administrator as the user ID to use for the install. If a checkbox that implies "Protect My Computer" or "Run with Restrictions" is available and enabled, uncheck the box to allow the installer to run with full install privileges.
Click 'Ok' to see the TM installer screens
Click 'Next'
Read the licence agreement and click 'Yes'
Click 'Next'
The installer will begin putting Theatre Manager into the 'C:\Program Files' folder.
Click 'Close'
|
||
| 3. |
|
||
| 4. | After installation, look for TheatreManager on the desktop or in the Start Menu and open Theatre Manager
|
||
| 5. | If you get asked to find a database, enter the IP address 127.0.0.1 below and click search. Normally, you should not need to do this as the Demo database is always assumed to be on the local machine. If you cannot connect to the database, check the following settings:
|
||
| 6. | If you are running a demonstration copy of the Theatre Manager application, you will see a first time setup screen asking you for your company information. All fields except the second line of address and the web site are mandatory. After you put this in the first time, you will not see it again. These fields are used during the demo to show how Theatre Manager verifies information for you. For example, the city, state and country you enter becomes the default country for new patrons that you may add to the database. The area code for the phone number fields becomes the default for patron entry, etc. Notice how Theatre Manager converts what ever you type into the proper case as it tries to assist in data entry. |
||
| 7. | Then, if you are able to connect to the database and enter the company information, then you will see the login window below. The password for any of the users in the demo is 'master'
|
||
| 8. | In a production environment, once you are connected to the database in step 5, you can run this the TMSetup.exe file on any other machine in the network. After changing the pg_hba.conf file, you should be able to connect to the database.
|
It is the client's responsibility to choose an option from those below and contact a processor or aggregator to set up a merchant account. We encourage clients to first advise the Arts Management Sales Team of their choice, as we have contact information for each option that can be used to seamlessly and quickly set up the proper type of account for use with Theatre Manager.
There is often confusion between the purpose of a bank, a processor, and an aggregator, and understanding the difference helps make sense of the authorization options available to you.
Processors provide the infrastructure to authorize cards and then deposit YOUR funds in ANY bank.
This option requires that a middleware credit card server called PCCharge be installed on Windows machine behind the DMZ. A venue needs to set up a merchant account with one of the 15 +/- supported processors (Paymentech, Elavon and Moneris are three of them). Installation is done using the standard PCCharge™ installers following the PCCharge™ Secure Implementation Guide.
With either type solution, the money always gets to your bank account. You enter or swipe the card information into Theatre Manager and it sends all the correct information to the appropriate service provider. The primary difference is that with the middleware PCCharge™, there are a few more potential points of failure in the communication chain - a TCP error at any point can cause Theatre Manager and the bank to see different things. It's not too critical as the difference is made obvious in the end of day process, and you can then go off and find (and correct) it. But it takes time. The following illustrates the difference in flow of the authorization. In any case, a merchant has to maintain a PCI-compliant office setup.
| Pro | Con | |
| Paymentech, Authorize.net, Moneris, Elavon |
|
|
| PCCharge |
|
|
The information that Theatre Manager requires from your Elavon setup will be:
The Agency ID, Admin ID and password will be sent to you in a document from Elavon. That document will also contain instructions for you to log in to the Elavon online gateway to activate your account.
Click here for detailed information on creating a merchant account in Theatre Manager.
Give a name to your Merchant Account. It could be your organization name or it could reference the merchant provider. Card use should be enabled at both box office and by the web listener (for clients using web sales). Server Software and Merchant Provider drop-downs should be populated with the Elavon options. The Agency ID from the document sent by Elavon to the client goes in the Software Type Tab.
Admin ID and Password from the Elavon document go on the Connection Info Tab. The Primary URL and Port should be populated for you. If not, make sure they match the above image.
For fraud prevention, Elavon accounts in Theatre Manager will be automatically set up to send address info and Track II data - just check to make sure your Authorization Tab matches the above image.
The Employees and Cards Tabs are populated the same as described here.
The installation instructions and operating manual is a downloadable PDF document. You will need to follow its PCI implementation guidelines.
During the upgrade to version 9, PC Charge must be upgraded from version 5.71 to 5.90 or later to maintain PCI PA/DSS 1.2 compliance.
Please refer to the PCCharge Setup process for everything required to setup a merchant account and any timelines suggested for new merchant accounts.
![]() |
PC Charge implements user id and password authentication over SSL connections with the various service providers (generally via port 5008) to ensure compliance with PCI DSS 4.1 |
|
Arts Management does not support Global Payments as a service provider with for new installations in Canada. |
![]() |
Paymentech Orbital implements either user id and password authentication; or access from specified IP addresses over https connections to provide compliance with PCI DSS 4.1 |
Installation is quite straightforward. You would contact Paymentech using information provided by Arts Management and they create a Merchant Account for you. Money gets authorized by Paymentech as 'Card Not Present' and then deposited right to your own bank upon settlement from Theatre Manager. This account information that you are provided is all you need to set up in the merchant setup window below to provide secure credit card authorization.
Paymentech Orbital will need to provide the following 2 account setups (both are required):
|
The user ids and passwords for both of the above are completely different and should not be interchanged or confused with each other. Follow the appropriate setup steps for each. |
After following the setup for both accounts, make sure to test the gateway.
The following values are set on the software type tab per the diagram below:
The following entries are set on the Connection Info tab per the diagram below:

If you need to have multiple merchant accounts and both are to take Visa (for example), you will need two Visa payment methods and assign one of them to each merchant account.
|
if you are switching from PC Charge to another merchant services provider software, you can open both merchant accounts and drag the employees from one window to the other. You can do the same for the credit card payment methods - to make the switch easy and fast. |
Any future dated 'post dated payments' associated with the card you drag to another merchant provider will automatically be re-assigned to authorize on the new merchant provider card network.
All users of the Orbital Virtual Terminal in conjunction with Theatre Manager are encouraged to download the Virtual Terminal Users Manual directly from Chase Paymentech. There is also a Virtual Terminal Quick Reference Guide available from the same site.
This is used to verify current and past batches, look at transactions, generate reports and manage your Orbital Gateway account.

Note the Auto Settle Section of the settings.


If you get a response that looks like it is HTML or XML and indicates that it was not authorized, then your user id/password is probably wrong (please verify), or Paymentech set up the account to require a specific IP. Contact your Paymentech representative and tell them of the issue so that they can correct it. They may put you in touch with the gateway people. The message to the Paymentech Gateway support staff is that you need to be able to authorize via user id and password (per their standard setup instructions for Theatre Manager).
![]() |
Authorize.net implements either user id and password authentication over https connections to provide compliance with PCI DSS 4.1 |
Installation is quite straightforward. You would contact Arts Management to arrange the process of creating a Merchant Account for you. Once set up, funds gets authorized as 'Card Not Present' and then deposited right to your own bank upon settlement from Theatre Manager. This account information that you are provided is all you need to set up in the merchant setup window below to provide secure credit card authorization.
Authorize.net needs an account setup for authorization and one for online viewing of the account data. You can set up multiple accounts for online access the data so some people can view data and others have more access to transactions and history.
|
The user ids and passwords for both of the above are different and should not be interchanged or confused with each other. Follow the appropriate setup steps for each. |
After following the setup for both accounts, make sure to:
The following values are set on the software type tab per the diagram below:
The following entries are set on the Connection Info tab per the diagram below:

While some employees may have permission to use multiple merchant accounts, viewing their name here is the default merchant account assigned to them for charging cards. If the employee wants to use another merchant account, they will need to select it on the payment window.
If you need to have multiple merchant accounts and both are to take Visa (for example), you will need two Visa payment methods and assign one of them to each merchant account.
|
If you are switching from PC Charge to another merchant services provider software, you can open both merchant accounts and drag the employees from one window to the other. You can do the same for the credit card payment methods - to make the switch easy and fast. |
Any future dated 'post dated payments' associated with the card you drag to another merchant provider will automatically be re-assigned to authorize on the new merchant provider card network.
If you get an authorization response that looks like it is HTML or XML and indicates that it was not authorized, then your user id/password is probably wrong (please verify it).
If is still doesn't work after verifying it, log in to the Online Merchant Account and
If an error occurs during the initial part of settlement, you may not have the 'Transaction Details API' enabled. If this occurs, log in to the Online Merchant account and then
If issues persist, contact Arts Management and let us know of the issue so that we can help get it corrected.
In order to process refunds in a separate batch from the original transaction (which is how most refunds occur), clients will need to download Authorize.net's Extended Credit Capabilities form:
http://www.authorize.net/files/ecc.pdf
Once the form is filled out and faxed back to Authorize.net, clients will be able to process refunds through Theatre Manager within hours.
Note: This is only for processing refunds in a separate batch, after the End of Day deposit has been done for the original charge. In cases where the card is to be refunded before settlement, users should instead Void and Delete the payment in Theatre Manager. Then the tickets can be refunded to clear the order balance that will be created when the payment is voided. There is no additional setup required through Authorize.net in order to process voids. For more information about voiding charges in Theatre Manager, click here.
It is also important to note that the ECC form will allow users to run a refund in any amount to a card without matching up the refund amount to the original charge. Because of this, there are a couple of important considerations:

Contact your Moneris support representative to have your account setup. Their eSelectplus is the product/account type to use.
|
You will also want to have Moneris add-on CVV verification to your account at the time of account set-up. Theatre Manager uses the CVV code on a credit card for security and for your (and your patrons') security. |
The information that Theatre Manager requires from your Moneris setup will be:
The merchant account number, Store ID and ECR Terminal ID will be sent to you in a document from Moneris. That document will also contain instructions for you to log in to the eSelectplus gateway to activate your account. Once you do that, you can obtain the API Token that will be required by the Theatre Manager merchant account setup.
You can use specific values for testing when setting up the gateway to ensure the connection is valid.
|
These values are open for general testing from all sources - so you may see more than just your test transactions in the virtual gateway. |
The following values will enable you to enter the test environment for the gateway:
To activate your eSelectplus account and get the API Token:
Note:The API Token above has been removed for security. Where the gray square appears, a combination of upper-case and lower-case letters and numbers will comprise your store's API Token.
By default, your eSelectplus account will be set to manually settle each night between 10 and 11PM Eastern time.
To alter this setting:
The Merchant Number from the document sent by Moneris to the client goes in the Software Type Tab.
Store ID, API Token and ECR Terminal ID from the Moneris document and from the online account (API Token) go on the Connection Info Tab. The Primary URL and Port should be populated for you. If not, make sure they match the above image.
On the Authorization Tab, be sure to uncheck Send address/zip box. Moneris does not use AVS by default (it's an account add-on). If a test charge results in a "no permissions for avs_info error," unchecking this box will address the error.
The Employees and Cards Tabs are populated the same as described here.
|
This process should only be undertaken in consultation with both Moneris Support and Arts Management Support. The API Token must match the Theatre Manager merchant account setup in order for credit card processing to work. |
Moneris Support may advise you to re-generate the API Token for your store in certain circumstances or for security reasons. If you are advised to do so, please contact support@artsman.com for instructions on changes within the Theatre Manager merchant account.
Installation is easy - just plug it into your computer.
It works by reading the card information, including the track II information into Theatre Manager. Theatre Manager encrypts the credit card. It forwards the track II information to the credit card company and then promptly forgets about it - Track II data is never retained in Theatre Manager per PCI DSS requirements. A number of credit card companies use Track II information as proof that the cardholder is present and may adjust discount rates. Note also that they adjust rates for full address verification, CVV2 verification and other factors - making it equivalent to Track II authorization.
|
Paymentech Orbital is only 'card not present'. That means Track II information is never send to them, even if the credit card is swiped using a USB reader. The card #, plus address and CVV2 are more important and will provide competitive discount rates. In this case, a USB swipe becomes only an efficiency tool for data entry rather than a need for proving card present. |
![]() |
Any computer that has a USB credit card reader attached to cannot be allowed to connect to the internet with direct access for browsing.
The reason for this protection is that the 'bad guys' have created viruses that are keystroke loggers. If your machine is infected, it will send every keystroke to the 'bad guys' and this is one easy way for them to compromise all credit card information. |
The PCI council has established 4 levels for merchant compliance; schedules 'A', 'B','C' or 'D'. You can use the table below to determine the level that applies to your organization below.
Theatre Manager can easily achieve schedule 'C' or 'D' compliance. Schedule 'A' and 'B' are far more difficult to achieve because of the definitions that the PCI council provide - essentially you must do paper processing of credit card and or use older, dial-up only, stand-alone terminals. Any merchant with walk up ticket sales of any volume and/or the faster stand alone internet terminals automatically default to Schedule 'C' as the minimum possible level based on the PCI definition.
Because of the inherent nature of the ticketing business has a combination of walk up, phone and/or internet sales, Theatre Manager (or any other ticketing system for that matter - hosted or non-hosted) needs to ensure that a vendor has their choice of Schedule 'C' or 'D' compliance - since the others are not possible and are intended to help small volume mom and pop corner stores be compliant through manual processing.
![]() |
Theatre Manager can implement either Schedule "C" or "D" for the SAQ - the choice is yours. You can define a retention period for credit card information in Theatre Manager on n the System Preferences on the PCI Security Tab screen before it is 'shredded' per PCI DSS standard 3.1 |
Notes:

![]() |
Credit cards stored in a database must be encrypted using a key that is distinct to the venue per PCI DSS standard 3.6. This must occur:
|
To change the cryptography of credit card information at any time:
You will see a dialog similar to the one below that asks you to confirm the step and the reasons why the step is required. Click 'Yes' to continue.
Some notes about this process:

This can be accomplished in a number of ways and can be done with one or two routers. This depends on the features in the router and ability to program it. The actual installation of Apache is described for Macintosh and Windows. While unsupported, it is possible to do it on Linux if you have the skill set to build apache and compile our module yourself.
Generally, the best approach is to have a single router that is capable of supporting a machine in a DMZ and creating rules that isolates the Apache web server in a vlan separate from the other machines on the network, with rules that specify the traffic that is allowed:
If possible, try and keep the apache machine on the same subnet as the other machine, even if it is in a different vlan in the router setup. This supports bringing new machines on as web listeners at a moments notice far easier because internally, they are all on the same sub net.
The second option is to have physically separate routers - which means the Apache server will have a different subnet range than the web listeners in the Office Network. It means that you will need to do some extra work:
The diagram below shows the differences between the two options.

You need to tell Theatre Manager web listeners where to find the apache server. You do this in company preferences >> Apache Server tab.
This is done once on initial setup. However if you change your internal IP subnets, you will need to make changes within Theatre Manager to reflect the new IP addresses.
|
There are two ways to set up the apache server. Using either a single DMZ or dual routers. |
If the apache server is on the same subnet (in a DMZ) as the web listeners, then all you do is make this one setting and it will handle multiple listeners. If you implement dual routers, then you will need to make NAT entries in the firewall if you wish to use multiple routers.
In general, the average venue has two listeners in case one computer fails. While unusual, computers do die so two reduces a point of failure. Since the price of a mac mini or a PC is low, the cost of expansion is minimal. (The little bit extra cost for Macs is worth it for unix underpinnings and, no virus, etc).
Very large on sales days or very large volume venues may want more than two listeners. For example, a venue turned on 7 listeners on the day they put their summer concert season on sale to handle $1.2M in sales - using average machines around the office - and turned them off the next day.
In the diagram below, extra listeners are simply started on any machine in the Theatre Manager Lan by going to the 'Patron Sales' menu and picking Web Sales Module->Web Sales Listener

If you are running a Mac as a web listener, you can setup two web listeners to work on one machine, effectively doubling the capacity of your web sales. Instead of using only one machine for one web listener, you can use one machine as TWO web listeners. This requires setting up a second user on the Mac, and running one web listener under each user.
If you are running OS Lion on your Mac, there are two considerations:
For Web Listener 1
| Step | Purpose |
| Step 1 | Alter the Port Forwarding Range for Web Sales on the router.
Typically, the Web Listener "listens" for all traffic on port 5111. This means that all traffic coming from the Apache server will be funneled through port 5111 to the Web Listener. Port 5111 is the traditional port if you only have a single Web Listener. If you plan to have multiple listeners, or even single machines functioning as multiple listeners, you need to open more ports than just 5111. This will require increasing the range to include Ports 5111, 5112, 5113, 5114, etc. depending on the number of listeners need. If you need assistance opening the ports, please contact your IT department. |
| Step 2 | Update Theatre Manger preferences file (plist).
|
For Web Listener 2
| Step | Purpose |
| Step 3 | Create a second login account on your Mac.
|
| Step 4 | Duplicate the existing copy of TM on the machine so there are 2 copies of TM (copy 1 and copy 2)
|
| Step 5 | Create a shortcut on the second user account desktop for TheatreManager2.
|
| Step 6 | Set preferences for the second user.
|
| Step 7 | Enable Fast User Switching on the Mac System Prefs under Login Prefs to switch between user 1 and user 2. For more information on Fast User Switching, click here. |
| Step 8 | Other configuration considerations.
|
|
Theatre Manager does not use the Apple version of Apache. It is often behind in versions and is configured specifically for how Apple Corp. likes things. Instead, Theatre Manager uses a vanilla version of Apache taken directly from the apache.org web site and compiled by us. This way, we can keep up with the latest patches as per PCI compliance and help you meet any compliance scan. |
In this example, the assumption is made the IP range of anything between the two firewalls will be 192.168.1.x. Please check with the local IT Administrator to confirm.
Notes:
| Step | Purpose | ||
| Step 1 |
It should automatically be placed into the software download folder and, depending on your settings, it may extract automatically. If it does not, then double click on the TMApacheSetup.zip file and it should create an executable 'TMApacheSetup.app' file like the image to the right.
|
||
| Step 2 | Double click on the TMApacheSetup to start the install. If you are asked if you want to run this file because it was downloaded from the internet, please do so. | ||
| Step 3 | You will be asked to authenticate the installer. Please type the user name of a person with administrative rights to this machine along with the password.
|
||
| Step 4 | When you see the splash screen, please click continue.
|
||
| Step 5 | Click continue on the license page. Feel free to read it if you wish.
|
||
| Step 6 | When the confirmation appears indicating that you have read the licence, please click 'Agree'
|
||
| Step 7 | You are now ready to install Apache on the mac. Click the Install button
|
||
| The progress bar will monitor the installation process.
|
|||
| Step 8 | When the end of the install occurs, click the 'quit' button.
|
| Step 9 | To begin the process of configuring Apache:
|
||||||||
| Step 10 | If the Apache preference pane does not open to the 'Status', tab, click the status tab.
|
||||||||
| Step 11 | Test the server to see if it starts out of the box
|
||||||||
| Step 12 |
We are now ready to configure the server for security and behaviour related items
|
||||||||
| Step 13 |
We are now ready to configure the httpd-ssl file.
Step 14 |
Restart Apache2
|
When the status says 'running' you can go on to the next step. If it is not running check the changes you made to find the issue. Step 15 |
If the restart of the server worked, then we need to test the apache server one more time If so, then it means that the apache module and configuration are correct. If not, it means that you may need to remove the /library/Apache2 folder and start the process from the top.
Step 16 |
Refer to any PCI consideration for installing Apache for late breaking security patches |
Step 17 |
Make sure to turn off airport, ensure there is a monitor, and deal with other power saving features. |
|
Notes:
| Step | Purpose | ||
| Step 1 | Download the latest installer using TMApacheSetup.exe and save it to the desktop
|
||
| Step 2 | Double click on the TMApacheSetup to start the install. If you are asked if you want to run this file because it was downloaded from the internet, please do so. | ||
| Step 3 | Click Next
|
||
| Step 4 | Click Next
|
||
| Step 5 | Select where you want to install the 'Installer' to.
This part of the install is not actually installing Apache (yet). It is only placing the install files on the computer. Once they files are there, then the actual Apache installer will run. We recommend that you accept C:/BoxOffice as the install location because that is where we put the PostGres install files as well. Click Next
|
||
| Step 6 | After all the files have been put in the correct location on the hard drive, you will be asked if you want to start the Apache installer at that time.
If you wish to, click 'yes' If you wish to do this later, you can go to C:/BoxOffice and run the 'ApacheInstaller' link
You will also be give the option of installing the FileZilla FTP server at the same time. This is used to let Theatre e-blasts automatically post jpegs to the apache server so that they will be visible for users. If you also want to install this, click 'Yes'. If you want to do it later, you can go to C:/BoxOffice and run the 'FileZilla installer' link
|
||
| Step 7 | If you clicked 'Yes' above, you are now ready to begin the install process for Apache on the PC. Click the 'Next' button
|
||
| Step 8 | On the license screen, click 'I accept the terms in the licence agreement' then click Next
|
||
| Step 9 | Click Next
|
||
| Step 10 | Apache needs a minimum amount of configuration. In the examples, you may just need to replace 'myserver.org' with your main domain name for your venue.
please enter:
|
||
| Step 11 | Click 'Typical' if it is not selected and then Click 'Next'
|
||
| Step 12 | Select the destination.
Please accept the defaults and click 'Next'.
|
||
| Step 13 | Click 'Install'
Apache will intall and register itself with the operating system
|
||
| Step 14 | Click 'Finish'.
If you opted to also install FileZilla, please follow the directions here and come back to continue with the rest of the Apache install.
|
| Step 15 | There are some manual steps to configuring Apache on the PC
Open up a view to the C:\BoxOffice folder where the installers were placed
Open up a second view to the C:\Program Files\Apache Software Foundation\Apache2.2 - or wherever you installed Apache. On a 64 bit operating system like 2003 server 64 bit, this could be C:\Program Files x(86)\Apache Software Foundation\Apache2.2
Files to move are:
|
| Step 16 | Test the server to see if it starts out of the box. At the lower right corner of the computer, there should be an icon that looks like a pencil (its really a feather) that is red and has a green triangle in it. If it is there, you are ready to skip to the next step and test the apache browser.
If the icon has a 'red' square in it, then click on the icon and you'll see and 'Apache 2.2 menu popup and then slide to the right and 'start' the server. If that does not work, please contact tech support as it means there is a configuration issue someplace.
|
| Step 17 | If Apache is running, then the next step is to test the browser before making any changes to the config file.
|
| Step 18 | We are now ready to configure the server for security and behaviour related items. We'll do this by copying some data from the sample httpd.conf file to the apache httpd.conf file.
NOTE: DO NOT REPLACE THE HTTPD.CONF FILE otherwise it will not work. You must copy/paste the configuration as follows
now in the httpd file in the conf directory in the Apache2.2
|
| Step 19 | Scroll back up in the conf file that you just pasted the code into (the one in the Apache2.2 directory, not the one in C:\BoxOffice). Look for a series of #LoadModule commands. It will look like the picture below. Near the end of them, about 8 lines up, there is a line that says
#LoadModule ssl_module modules/mod_ssl.so remove the '#' from the beginning of that line. Save the file
Scroll down in the conf file (the one in the Apache2.2 directory, not the one in C:\BoxOffice). About 1/3 of the way through the document there is a line that says: #ServerName tickets.mytheatre.org:80 remove the '#' from the beginning of that line. Save the file
Scroll down in the conf file (the one in the Apache2.2 directory, not the one in C:\BoxOffice). About 3/4 of the way through the document the EnableMMAP information will appear. If this machine is running a 32 bit operating system make the following changes:
Save the file
Scroll down in the conf file (the one in the Apache2.2 directory, not the one in C:\BoxOffice). Just above the copied text for Theatre Manager there are lines that says: # Secure (SSL/TLS) connections remove the '#' from the beginning of the Include conf/extra/httpd-ssl.conf line. Save the file
|
| Step 20 | Scroll back to the bottom of the httpd file that you are editing.
|
Step 21 | It's now time to configure http-ssl.conf file. We'll do this by copying some data from the sample httpd-ss.conf file to the apache httpd-ssl.conf file.
NOTE: DO NOT REPLACE THE HTTPD-SSL.CONF FILE otherwise it will not work. You must copy/paste the configuration as follows
now in the httpd-ssl file in the extra directory in the Apache2.2/conf
Now copy both the server.crt and server.key files from the C:\BoxOffice\conf folder and paste them into the Apache2.2/conf folder |
| Step 22 | Click on the Apache monitor icon in the lower right tray and you'll see and 'Apache 2.2 menu popup and then slide to the right and 'Restart' the server. If that causes the green triangle to go to a red square, please contact tech support as it means there is a configuration issue someplace.
Optionally, go back through the changes that were made above to the httpd.conf file and see if you can spot the mistake.
|
| Step 23 | If the restart of the server worked, then we need to test the apache server one more time
If so, then it means that the apache module and configuration are correct. If not, it means that you may need to remove the C:\program Files\Apache Software Foundation directory and start the process from the top.
|
| Step 24 | Refer to any PCI consideration for installing Apache for late breaking security patches |
[warn] The specified network name is no longer available. : winnt_accept: Asynchronous AcceptEx failed
then please find and edit the httpd.conf file as per below.
For clarity, the lines should look like the following without any comments
EnableMMAP off
EnableSendfile off
Win32DisableAcceptEx
and make sure to stop, restart apache and test a connection to it.
The following is a general set of steps to put the module in place. It is assumed that the reader has extensive linux knowledge. This assumes that you have either 32 bit or 64 bit apache 2.2 installed. This has been tested with 2.2.15.
| Step 1 |
Restart and test the apache server by
If so, then it means that the apache module and configuration are correct. You should also see at least files created in the 'data' directory that contain the state of the active listeners. If not, it means that you may need to look at the apache logs to determine what the issue is and/or redo the process from the start. |
| Step 2 | Refer to any PCI consideration for installing Apache for late breaking security patches |
The following is a general set of steps to put the module in place. It is assumed that the reader has extensive linux knowledge. This assumes that you have 32 bit apache 2.2 installed. This has been tested with 2.2.15.
| Step 1 |
Restart and test the apache server by
If so, then it means that the apache module and configuration are correct. You should also see at least files created in the 'data' directory that contain the state of the active listeners. If not, it means that you may need to look at the apache logs to determine what the issue is and/or redo the process from the start. |
| Step 2 | Refer to any PCI consideration for installing Apache for late breaking security patches |
The 1.4.2 version of the Apache Module is known to cause Apache to restart resulting in Theatre Manager's web listener crashing. This issue can be addressed by upgrading the version of the Apache Module to 1.4.5 or higher, or downgrading to version 1.2.9.
Which to choose:
Steps to install the module:
To set it up, you will need to:
A Theatre Manager user create the form letter using drag-and-drop for images. Theatre Manager recognizes all pictures in the form letter, places them on the Apache server and sends out the form letter email with the pictures as links rather than storing multiple copies of an image in the database.
At no time does the patron have FTP access to the apache server. Likewise, the internal user should not have FTP access beyond sending pictures to the Apache Server. Since the 'account' settings are in company preferences, most Theatre Manager users should not be aware other than this 'just happens' in the background.
Some set up is required before the new feature will function. The following pages include step-by-step instructions for setting up FTP access to the htdocs folder on the Apache server and for setting up Company Preferences inside Theatre Manager with that access.
Before you can utilize Theatre Manager's What-You-See-Is-What-You-Get (WYSIWYG) eblast capabilities inside Form Letters, you will need to set up FTP access to the Apache Server htdocs folder.
Read more about the functionality in the release notes for 9.00.Select the instructions for the appropriate platform below.
|
you are making your selection based on the type of machine (Mac or PC) that is running Apache and contains your htdocs folder (not your personal workstation). |
You will first have to set up a new, non-admin account on the Apache server itself. To do so:
button near the center of the screen. In the window that opens, in addition to the default options, select "Share files and folders using FTP" then click Done. Only 'Share file and folders using FTP' is required for email blasts and depending upon shared folder requirements within your organization, you may be able de-select the defaulted 'Share files and folders using AFP' option.
If you are running OS Lion the option for Share Files and Folders Using FTP will not appear in the list. Check the option for Share Files and Folders Using AFP. To initiate file sharing for OS Lion open Terminal and type the following command:
sudo launchctl load -w /System/Library/LaunchDaemons/ftp.plist
Each user does not need to know the user id and password. Theatre Manager moves the files automatically based on settings in Company Preferences.
| Step | Purpose |
| Step 1 | Click 'I Agree' to the licence window after reading it (if you wish).
|
| Step 2 | Ciick 'Next'
|
| Step 3 | Click 'Next'
|
| Step 4 | Click 'Next'
|
| Step 5 | Click 'Install'
|
| Step 6 | Click 'Close'
|
| Step 7 | FileZilla server is already started. A window appears asking if you want to start the interface to the FileZilla server so that you can set up users and a path name to the 'eblastimages' folder for each outlet.
Click 'OK'
|
| Step 8 | This is the interface to FileZilla
|
| Step | Purpose |
| Step 1 | In the Filezilla Server Interface, click Edit and select Users
|
| Step 2 | Click the Add button button under the Users box on the right of the Users setup. Enter a name for the user and click OK.
|
| Step 3 | Check the box and set a password for the user in the Account Settings box in the top center of the window.
|
| Step 4 | Select the Shared Folders option in the navigation tree on the left of the window.
|
| Step 5 | Click Add to browse for your "htdocs" folder that contains your web pages. If you followed the apache installation instructions here, it should be at C:\Program Files\Apache Software Foundation\2.2\htdocs and then click OK.
Give full access to all eight checkboxes to the user (Read, Write, Delete and Append access to Files, Create, Delete, List and + Subdirs to Directories).
|
| Step 6 | Click OK at the bottom left to complete the process of adding the user and shared folder. |
After configuring Filezilla, you will need to add the user and password you created to Theatre Manager's Company Preferences following these instructions.
At a minimum, you will need to open TCP port 21 and that may be enough.
For some versions of Microsoft Windows (eg Windows 7), you may also need to add the FileZilla program to the list of applications in the firewall set up that are allowed to have outside access.
Both of these changes are done by accessing Start->Control Panels -> Windows Firewall
Button to test whether you have set things up correctly. There are two ways to tell. The first is that you will see the following message at the bottom of the Company Preferences window just under the Test FTP Button:

Try:
If you are having issues connecting to your ticketing web site while inside the office and are receiving timeouts, this is often resolved by editing the hosts file on each machine or adding an internal DNS entry to point to your ticketing web site.
Mac's are not usually subjected to this issue. PC's inside the office frequently are because they do not always seem to be able to resolve the DNS that goes outside the firewall and back in, so you have to edit the hosts file to tell the PC how to find the web site.
The date in front of the web pages below indicate approximately when the fix was released.
Periodically, you may need to upgrade Apache to the latest version to simply eliminate some PCI scan messages (see links below). We attempt to incorporate each advisory in the latest installs where possible.
note: this change is included in the latest install of apache. Older sites will need to make this change.
#
# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list.
# Updated the following Apache Core Features for PCI Compliance reasons
# Refer to: http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslprotocol
# Refer to: http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html
# Synopsis : The remote service supports the use of medium strength SSL ciphers.
# Description : The remote host supports the use of SSL ciphers that offer medium
# strength encryption, which we currently regard as those with key lengths
# at least 56 bits and less than 112 bits.
# Solution: Reconfigure the affected application if possible to avoid use of medium
# strength ciphers.
#SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLProtocol -all +TLSv1 +SSLv3
SSLCipherSuite HIGH:!aNULL:+SHA1:+MD5:+HIGH
Edit the httpd.conf file and add changes as below at the end of the file. They address some recent items that PCI security scans now look for.
# ---------------------- to tighten security in browser ----------
# Updated the following Apache Core Features for PCI Compliance reasons
# Disable the TRACE/TRACK command
# refer to: http://httpd.apache.org/docs/1.3/mod/core.html#traceenable
TraceEnable Off
# To enforce or deny complete folder listing
# refer to: http://httpd.apache.org/docs/1.3/mod/mod_autoindex.html#indexignore
IndexIgnore *
The PCI guardians have determined that they do not like any hidden files in the htdocs directory as they view it as a possible attack vector - and if a PCI compliance scan finds these, it will flag you as non-compliant. The response is:
Use Cronnix to create a daily job on your apache machine to run this script. It is installed as part of the Apache installer into your Applications folder'. The setup is similar to below.
Edit the httpd.conf file and add changes as below at the end of the file. They address some recent items that PCI security scans now look for.
# To remove Inode information from ETag
FileETag MTime Size
The remedy is to download and install an another flavor of Apache and upgrade that version of Apache to use OpenSSL 1.0.0.d or higher from Apache Haus
NOTE: Apache 2.2.21 and OpenSSL 1.0.0d are the most recent versions available as of updating this web page on Oct 17, 2011. The respective organizations who maintain the installers for Apache and OpenSSL may release new updates at any time. It is your organizations responsibility to check that they are installing the most recent version at the time of update.
Your options are:
There is a bit of work to do to perform this and takes approximately 1 hour worth of time. Web sales will need to be taken offline for approximately 5 minutes during the process -- meaning you can do this upgrade during a time when there is minimal web sales activity.
Then try your PCI scan again. We understand from the PCI council that you have approximately 30 days from identification of the problem at your venue to resolution. Select a slow day to do the upgrade as it should only take approximately 1+/- hours to complete. (as this may be your first and perhaps only time doing it, we would recommend that you allocate 2+/- hours just in case)
If you wish to have Arts Management perform the above upgrades to your copy of Apache, please let us know and we will schedule a date/time with you. It typically takes approximately 1+/- hours to complete and is deemed a billable service.
Some of the gotcha's you may encounter along the way are:
We have tried the following OpenSSL links, however they did not prove to be successful when using the OpenSSL 1.0.0.d upgrade with the standard installation of Apache 2.2.17
The latest version of our apache installers for OSX include openssl 1.0.0e and all you need do is upgrade to the latest version of Apache.
![]() |
PCI compliance indicates that you need to update system components after they are released and/or if you fail a PCI compliance scan. |
If you wish to do this yourself, the steps are, in general:
The OWASP Top 10 for 2010 is interesting reading for application developers, web site builders and end users. The internet has many good features, but it is not a safe place if you are not aware.
![]() |
Each year, the Arts Management team reviews the top 10 and, for those that are applicable, ensures that the web sales module provides a defence against the top 10 per PCI standard 5.1. Responses are posted here. Merchants should also be aware of these. |
| Description | Thestre Manager Implementation | |
| A1 | SQL Injection | OWASP 's preferred option is to use a safe API which avoids the use of the interpreter entirely or provides a parameterized interface.
In Theatre Manager, all web pages access the web listener using an API and each parameter is scrubbed on the way to the web listener for specific values. |
| A2 | Cross-Site Scripting (XSS) | OWASP 's preferred option is to properly escape all untrusted data based on the HTML context (body, attribute, JavaScript, CSS, or URL) that the data will be placed into.
Theatre Manager looks for any attempt to put javascript and other characters into a form and simply removes them. We have determined that there is no valid need to have words like <script> in a enterable fields like name or address. |
| A3 | Broken Authentication and Session Management | Theatre Manager uses cookies for session managment. All data in the cookie is 3DES encrypted, along with a date and time.
If the web listener notices that the cookie comes back and is an earlier time than expected, then it discards the request. There are no session ID's allowed in the URL. |
| A4 | Insecure Direct Object References | Theatre Manage does not allow direct access to any object in the database through the user of an API. Users cannot retrieve data in an unauothorized way. |
| A5 | Cross-Site Request Forgery (CSRF) | Theatre Manager does not allow access to the database except via API. It also forces a timeout for inactivity.
At worst, a hacker taking the time and effort to put an API call into a jpeg and tricking a person buying tickets into sending that to your Web Listener might find a seat or add a ticket to a shopping cart. The key is that the impact, should it even happen, is low. |
| A6 | Security Misconfiguration (NEW) | The primary prevention to this is PCI security scans and upgrading of Theatre Manager components on a regular basis and following any implementation notes. |
| A7 | Insecure Cryptographic Storage | Theatre Manager handles encryption of the key card information and reommends shredding of unused data after a period of time.
The majority of this OWASP item refers to storage, backups and a venue's internal processes. |
| A8 | Failure to Restrict URL Access | This does not apply to Theatre Manager's web lsiteners due to the API's used to control access to the system. Accessing the limited number of web pages in the htdocs directory in a direct manner does nothing unless they are processed by a web listener. Further, all requests are send through a specialized Apache module that adds additional tokens not known visible in the browser and re-routes the URL and does some NAT translation of its own. |
| A9 | Insufficient Transport Layer Protection | Theatre Manager web listener suggests using SSL for all traffic - which mean turning on port 443 to the apache server.
Ensuring the SSL certificate is current is a responsibility of the monthly PCI scan process. |
| A10 | Unvalidated Redirects and Forwards (NEW) | Theatre Manager does not use re-directs in any web page. |
Before you can get an SSL certificate, you will need a static address for your router and a 'nice' domain name like 'tickets.yourvenue.org' that points to your firewall. Both of these are supplied by your webhosting company. The steps you will need to follow to set up an SSL and get web pages working are in the following sections.

The static IP must be obtained first and is supplied by your ISP. It will be set up in your firewall/router so that it never changes and means that customers will always be able to find you on the internet.
These generally cost about $10 to $20 monthly in addition to your connection fees, unless you have a business internet package - in which case you probably get one included.
If you have a static IP and do not recall it, then open up a browser and type 'whatsmyip.org'. This asks a web site to tell you what the IP address of the outside of your router is. Alternately, you can enter the config mode for your router to determine the static IP address.
You can think of this as a 'nice' name by which customers can find you, or if they see it in the URL area of the browser, they will be confident that they are connecting to the right web site.
Call up your ISP (or web site hosting company) and ask them to create a DNS record for 'tickets.myvenue.com' (where myvenue is replaced by your main web site name). As an example, if your main web site is www.artsman.com, then you would like your ISP to create a DNS record for tickets.artsman.com.
Possible DNS names that you may prefer from a marketing perspective are:Once the DNS record has been created and is propagated to the internet (this usually happens in a few hours but can take as long as 24 hours), the next step is to purchase and install the SSL certificate.
If you purchase your own SSL certificate from another source, you will need to install it yourself following the instructions provided to you during the purchase process and make sure it works. If you have any questions about your Self Purchased SSL certificate, contact the company from whom you purchased it for any and all assistance.
Arts Management Systems uses 256 bit encrypted premium certificates from GeoTrust and if you wish to purchase one, please contact the sales office at (403) 536-1214. We will install any SSL certificate purchased from us and install a secure SSL logo on the checkout page of Theatre Manager.
When you buy an SSL from Arts Management Systems, information that we will require from you in order to customize the SSL to your venue are:
Once the firewall has been opened and the SSL certificate installed:
This page shows safari with the lock on the upper right turned on
This page shows firefox with the lock on the lower right turned on
Please check for it on your browser as appropriate.
The best approach is to put an entry within your internal DNS server to point 'tickets.myserver.org' directly to the internal address of the apache server.
If that is not possible, you may have to make an entry in the hosts file of each web listener that points to the apache server if the DNS does not propagate in the internal network. If the Web Listeners start up and are able to find the 'tickets.myvenue.org', you will not need this step. If they do startup but they seem to be ignored by apache very quickly, then you will need this step.
The hosts file is located and edited as follows
| Windows | c:/windows/system32/drivers/etc/hosts (or where the windows system32 directory is located)
Navigate to this using the file system and edit it with WordPad and place an entry at the end for 'tickets.myvenue.org' that looks like the following. Replace 192.168.1.xx with the address of the machine that is the Apache Web Server that is within the DMZ
|
| OSX | /etc/hosts
To edit this file on the mac, open up 'Terminal' type cd /etc type sudo vi hosts type the administrator password to the machine A file should open similar to below. use the arrow keys to scroll down and edit it to look like below. Replace 192.168.1.xx with the address of the machine that is the Apache Web Server that is within the DMZ. type 'I' This will put you in edit mode Type the text as required to add the line to the end. When the changes are made hit the 'ESC' key. Hold the SHIFT key down and type Q Type WQ
|
![]() |
There are some settings in Theatre Manager that a venue must examine during installation and may need to be changed for PCI standard 8.5 compliance.
If you are upgrading from a demo version of TM, some of these settings were optional to facilitate the purposes of a demo and need implemented for a production system. |
Ensure that the minimum recommended settings are met and increase the security as you see fit. If the minimum recommended settings change, Theatre Manager will automatically update the current settings to any more current minimum during any upgrade.
The steps to increase security strength are:

If you wish to implement login by user id in addition to password, the change all the user id's in the system to a scheme that is suited to your network security needs. Since you will be logging in with a User Id and Password, it can be a good idea to make user names more difficult to determine.
To change user names and password settings, repeat the following steps for all users EXCEPT the Master User:

![]() |
You must at least visit the 'Functions' tab and make sure that any of the privileges that say 'Credit Card' in the second column are all unchecked to start with. Then enable those that you wish the user to have. Creating any new normal user will default to a 'deny-all' setting per PCI DSS 7.2
All existing users can be easily reset to the 'deny-all' at one button click (see below) |

You can do reset all employees with non-administrative access at one time by selecting them all on the list of employees and clicking the 'PCI' button.

Per PCI requirements, this password for this account must be changed at the initial installation of Theatre Manager by the venue so that it is something unique to the venue.
No user of Theatre Manager is required to have these privileges in order to use the system - except to create another user account. If any user is set as a Master User for the duration of the installation process, those privileges should be revoked per PCI compliance.
The intent with Theatre Manager web sales is that a venue can customize the pages in any way they wish since they are generally only HTML based pages that can easily be edited with a WYSIWIG editor like Adobe Dreamweaver as long as the basic <form> submission are not altered, or are replaced by the equivalent API call using javascript.
The release notes for Theatre Manager will provide a list (and file) indicating which web pages have changed, and if possible, what the general intent of the change was. To implement these changes, you need to:
This can be done by hand or you can use automated tools to help identify exactly what has changed. We recommend using some automated tools.
While you are testing your web site, or your customers are using web sales, you may see text on a page that you think could be worded more suitably for your venue. The best way to find the page to change is to do a multi-file text search to find a portion of the text.
You would search within all the files in the HTDOCS folder on the Apache server. Good options for multi-file text searching are:
We recommend Dreamweaver as it is a probably the easiest HTML editing tool. It can be purchased for about $25.00 for non-profits through www.techsoup.com. Notepad++ is free. TextWrangler is also free from the makers of BBedit. BBedit costs about $40 and is a programmer type tool - but we really like it.
You can do it either on a subset of pages provided with each upgrade to identify the key differences, our you can compare your entire htdocs folder on the Apache server with the most recent htdocs folder supplied by Arts Management. In either case, the general approach is:
Start BBedit or TextWrangler and then go to Search->Find Differences. In the find differences window that opens, put the names of the old and new htdocs folders as per the picture below and click Compare.
You can do this either using a subset of pages provided with each upgrade to identify the key differences, our you can compare your entire htdocs folder on the Apache server with the most recent htdocs folder supplied by Arts Management. In either case, the general approach is:
Start WinMerge and pick the File->Open menu. You will be asked to pick the folder for the left side (pick the old htdocs directory) and the folder for the right side (pick the new htdocs directory).
Decide which changes should be merged into your web pages. This shows you the actual differences in the files highlighted in orange. Repeat this decision making for all files that are different.
http:// tickets. yourserver. com [/TheatreManager/1/login[&action=0|number][&lang=XX][&tmsource=YYY]]
where the meaning of the parts of the above syntax is:
The following are specific examples of links that can be added to your main website:
The general starting place for all sales might be a link like like the one that follows which is placed on your main web site:
Click here to purchase tickets (all available events) - https://tickets.myserver.com which actually lands on the index.html page. The index.html page is usually set up to redirect the user automatically to the list of events. The same can be accomplished by directly coding a link with login&event=0 similar to
https://tickets.myserver.com/TheatreManager/1/login&event=0.
To force the patron to go to the logon widow:
Click here to log in https://tickets.myserver.com/TheatreManager/1/login
If you wish to have links beside each event that you advertise on your web site:
Click here to purchase tickets to Event #1 - https://tickets.myserver.com/TheatreManager/1/login&event=297
Click here to purchase tickets to Event #2 - https://tickets.myserver.com/TheatreManager/1/login&event=298
Click here to purchase tickets to Event #3 - https://tickets.myserver.com/TheatreManager/1/login&event=294
Click here to purchase tickets to Event #4 - https://tickets.myserver.com/TheatreManager/1/login&event=295
Click here to purchase tickets to Event #5 - https://tickets.myserver.com/TheatreManager/1/login&event=296
where the event value is defined by Theatre Manager as the unique event number for each of the different events you have. The event number is found by:
icon to populate the Event List
If you wish to have links for genre's of events you can use a link like the following - please note that you must specify &event=0 with the &genre=yyy parameter. These are the same ones that are defined for ticket trove and cannot be changed by the venue. You can find the values for yyy in the 'event genre' code table.
Click here to purchase tickets to a specific genre. https://tickets.myserver.com/TheatreManager/1/login&event=0&genre=200
If you have an event that only has a single performance, you can go directly to selling that performance (bypassing the event selection) by:
Click here to purchase tickets to GalaDinner - https://tickets.myserver.com/TheatreManager/1/login&performance=1568
where the 'performance' value is defined by Theatre Manager as the unique performance number.
To find the performance number:
icon to populate the Event List 
If you have a venue description that has different type of events, you can go directly to selling any performance in that venue by:
Click here to purchase tickets for this venue - https://tickets.myserver.com/TheatreManager/1/login&venue=1
where the 'venue' value is defined by Theatre Manager as the unique venue map number.
To find the venue map number:

If you have a subscription and want to go there directly, you can have: Click here to purchase subscriptions - https://tickets.myserver.com/TheatreManager/1/login&subscription=1
where the 'subscription' value is defined by Theatre Manager as the unique subscription number for that subscription package.
To find the subscription number:
icon.
If you have a specific list of events, or date range of events, you can create a customized search Click here to purchase tickets to Event - https://tickets.myserver.com/TheatreManager/1/login&event=0&search=XXXXXX
where the XXXXXX is a valid sql search of Theatre Manager's database to retrieve events for sale. Do NOT place quotes around the entire search parameter that you are creating. For example:
Refer to comments within htdocs/1/WebPages/TMTickets.html for more examples of searching for performances within the Ticketing Page.
See the relevant sections above on where to find event, performance and venue numbers within Theatre Manager.
This will take you right to the donation page to allow the patron to select which campaign they want to donate towards
Click here to make a donation - https://tickets.myserver.com/TheatreManager/1/login&donation=xx Where "xx" represents the Seq # associated with the Donation Campaign that will appear as the default in the drop-down menu on the web page. To find the Seq # for the Donation Campaign:
icon in the Campaign List Window to see the Donation Campaigns and reference the Seq # for each

This will take you to the pass/Gift Certificate/merchandise page.
Click here to purchase a gift certificate - https://tickets.myserver.com/TheatreManager/1/login&pass
This will take you to the mail list page.
Click here to purchase subscribe or be removed from a mail list -https://tickets.myserver.com/TheatreManager/1/login&maillist
Keep in mind, with this link, the user MUST log in first before their mail list options will appear.
When you are looking at a web page, there is often distinguishing text on the web page that might give a hint. For example, the checkout page typically has words like 'Credit Card' on it. To find out which file that could be, use one of the useful text editing tools and search for that text within the WebPagesEN folder. That will often indicate which page has what you desire to change. Then just edit it.
In the main directory, the file names often refer to the usage of the file. If you cannot find a file based on searching for its contents, then the names often give a clue. 'TMCart', for example is the shopping cart page. TMTickets is the list of ticketed events. TMHome is the 'home' page. Most of these can be found by searching based on content (the first strategy).
However there are a number of helper folders as follows:
The Web Pages used by the Web Sales Module contain tags and strings required by Theatre Manager to send and receive the correct data to and from the database. The Pages themselves are provided by Arts Management Systems upon purchase of the Web Sales Module, and the source code remains the property of Arts Management Systems.
All pages can be edited to fit within the overall scheme of the pre-existing website and the web sales component will fit seamlessly.
However, there are many different strings and types of tags required to be kept as they are provided, so that the site will operate as it was designed.
|
You can edit the Web Pages provided, but Arts Management Systems is not responsible for supporting or debugging errors that may occur. |
There are several types of texts within the code of each page that use the comment tags (i.e. <!-- BLANK -->).
<!--#include virtual="TMtemplates/tmnavButtons.html" -->
Although the <include> tag looks like a comment tag, it is read in by the page.
If a mistake is made, or a user needs to be prompted to do something, a message appears at the top of the pages. By default this message appears in red. Within the code of the pages you these messages are pulled in by the <field>F_HTML_PAGE_MESSAGE</field>.
If you want to change the wording of these messages, you can edit the TMError.txt page in the WebPages directory. We recommend using Microsoft Excel to open the document. You may then edit the Error Text column. Change the wording of the messages to whatever you like.
|
Any message that has the double dollar signs ($$) in it indicates that a database field inside Theatre Manager is being pulled into the message. For example, if you look at error number 10021, the message is "Welcome $$". The dollar signs in this case represents the first name of the patron that will be pulled into the message. |
Almost every page uses Javascript. The Javascripts are called in at the beginning of each page using <include> tags. these should remain in the page through any changes, unless the developer is sure that the function of the javascript is not needed. If the javascript is removed, and the site is no longer able to function as it was intended, Arts Management Systems will not be responsible for recovering the code.
Click here for more detailed information about the different functions javascript plays in the web pages.
When viewing the web page code, there are strings that appear as <field>XXXXXXXXX</field>.
These fields are internal Theatre Manager fields, and should never be altered. In most cases, they reference information entered within Theatre Manager. If these values need to be changed, you should change them in Theatre Manager, not in the web page code. Any text within the X when viewed as source code, will identify what the string is linked to.
The Web Server URL field will contain the sub-domain or A record for the online ticketing site and will looks something like https://tickets.myvenue.org. The setup of the A record should point to the external IP address of the organization for routing purposes. The external IP can be determined by going to http://www.whatismyip.com. The internal network will then redirect the communication to the Apache machine.
<base href="https://tickets.yourvenue.org/1/WebPagesEN">
Where tickets.yourvenue.org is pulled from the F_HTML_FIREWALL reference and the F_HTML_IMAGE_SERVER adds the /1/WebPagesEN indicating the path of where the images will be referenced.
Click here for Internal Variable Theatre Manager Fields.
The buttons used by Theatre Manager for navigation within each Web Page (not tmnavSide.html) are regular form input buttons. They have been altered using Cascading Style Sheets and javascript so that they are customizable in colour and style.
Click here for information about Navigation Buttons.
The style sheets are used with the Web Pages are: stylePages.css and styleButtons.css. They are linked to each page with strings.
href="/installing-theatre-manager/stylebuttons">Click here for details on the different styles for the buttons.
href="/installing-theatre-manager/stylepages">Click here for details on the different styles for the pages.
These are the different types of internal Variable Theatre Manager Fields.
F_HTML_FIREWALL - The A record of the Web Server URL as set in the Apache tab of Company Preferences
F_HTML_IMAGE_SERVER - Web Pages path of the Image/Gif server as set in Web Listener tab of Company Preferences in conjunction with the Outlet Number of the database.
F_HTML_PAGE_IDENTIFIER - the Page Identifier which maintains the patron's connectivity during a session
F_HTML_PAGE_MESSAGE - The Theatre Manager message relative to each page
F_HTML_PARAMETER - an internal connectivity number that follows pages (should not be removed from the page)
F_HTML_SELECTED - the selected line in the shown list
F_HTML_CART_STATUS - Status of the shopping cart
F_HTML_REMOVE_CART_ITEM_YN - Removing cart items - Yes or No
F_HTML_NEXT_BEST_SEAT - A field put in the confirm reserved seat page used for the 'find next best seat' function. This works in conjunction with 'btnBestAvail' and the value is filled in by Theatre Manager
F_HTML_NEXT_BEST_AREA - Also put in the reserved seating confirmation page. This field pulls from the Best Seat Setting tab of the Map in Theatre Manager. It carries forward the section that the user was searching.
F_EMAIL_ADDRESS - The current logged in user's Email Address
F_LOGGED_IN - This is a boolean flag indicating if the user is logged in (0=not logged in, 1=logged in). It can be used to display state on the left navigation bar
F_SOLD_PERCENT - This is a number (0-100) that indicates the percentage that a performance is sold. Can be used in rowTicketEvent.html to create a visual indicator of seat availability.
All of the list variables pull their information from the rowXXX.html and setXXX.html files that are in the TMtemplates folder of the WebPages folder.
F_HTML_BEST_SEATS_LIST - List of available best seats
F_HTML_CAMPAIGN_LIST - List of available Campaigns
F_HTML_COUNTRY_LIST - List of the active countries
F_HTML_CURRENT_CART_LIST - List of any current Shopping Carts
F_HTML_EVENT_LIST - List of any current Events
F_HTML_HISTORICAL_CART_DETAIL_LIST - List of details of past shopping carts
F_HTML_HISTORICAL_CART_LIST - List of past shopping carts
F_HTML_MONTH_LIST - List of months for event selection
F_HTML_PASS_LIST - List of available Passes/ Memberships
F_HTML_PAYMENT_LIST - List of available payment methods
F_HTML_PERFORMANCE_LIST - List of available performances
F_HTML_PREFER_HTML_LIST - List of patrons who prefer html emails to text
F_HTML_PROMOTIONS_LIST - List of available Sales Promotions
F_HTML_PROVINCE_LIST - list of available Provinces/ States
F_HTML_SUBSCRIBE_LIST - List of patrons who are subscribed to a specific mail list
F_HTML_TICKET_QTY_LIST - List of available quantities of tickets for the event
F_HTML_UNSUBSCRIBE_LIST - List of patrons who have Unsubscribed to a mail list
F_HTML_YEAR_LIST - List of years
Database Fields
For an up to date list of the merge fields and their meanings, from Theatre Manager, print the Utility Functions and Database Analysis report - Database Dictionary and Layout.
C_ADDRESS1 - Patron's primary Address Line 1
C_ADDRESS2 - Patron's primary Address Line 2
C_ALT_EMAIL_ADDR - Spouse's email address
C_CITY - Patron's City
C_COMPANY - Patron's Company
C_EMAIL_ADDR - Patron's email address
C_FAX_PHONE - Patron's Fax
C_FIRST_NAME - Patron's First Name
C_FIRST_NAME2 - Spouse's First Name
C_HOME_PHONE - Patron's Home phone
C_INITIAL - Patrons Middle Initial
C_INITIAL2 - Spouse's Middle Initial
C_LAST_NAME - Patron's Last Name
C_LAST_NAME2 - Spouse's Last Name
C_PASSWORD - Patron's Password
C_POSTAL_CODE - Patron's Postal Code
C_PROVINCE - Patron's province
C_SEQ - Patron number
C_WEB_LAST_LOGON - Patron's date of last login
C_WEB_PREFER_HTML_LIST -
C_WORK_PHONE - Patron's work phone
C_WORK_PHONE2 - Spouse's work phone
SPR_BACKUP_ELAPSED_TIME - Elapsed time into backup
SPR_FORCE_LOGOFF_DAILY_AT - Time at which users are forced off for backup
SPR_TAX1_DESC - Description of Tax Code #1
SPR_TAX2_DESC - Description of Tax Code #2
SPR_TAX3_DESC - Description of Tax Code #3
DD_CORPORATE - flag indicating a corporate gift (true or 1), or not (false or zero)
DD_AMOUNT_PLEDGE - Amount of gift given on the internet
DD_NAME_OF - Donor's name
DD_PROGRAM_YEAR - the program year in which the donor is to be recognized
DD_FLD1_FC_SEQ - key indicating the value of the donor popup field #1 - must be in code tables to be valid
DD_FLD2_FC_SEQ - key indicating the value of the donor popup field #2 - must be in code tables to be valid
DD_FLD3_FC_SEQ - key indicating the value of the donor popup field #3 - must be in code tables to be valid
DD_FLD4 - text field indicating a value for donor field 4 (can be used for a short comment if desired)
DD_NOTES - large text field for a description of the donation
D_DONATION_DESC - Description of this donation
D_DONOR1_DESC - Description of custom field 1 for donations
D_DONOR2_DESC - Description of custom field 2 for donations
D_DONOR3_DESC - Description of custom field 3 for donations
D_DONOR4_DESC - Description of custom field 4 for donations
D_FESTIVAL_DESC - Description of a Festival or General Admission event
D_MAIL_FEE_AMOUNT - Amount of mail Fee
D_MEMBER_DESC - Description of this Membership/Pass/Gift Certificate
D_SECTION_DESC - Site description for 'Section'
D_ROW_DESC - Site description of the 'Row'
D_SEAT_DESC - Site description for 'seat'
D_WEB_FEE_DESC - Description of this Web Fee
D_WEB_LISTENER_IP_PORT - the port that the web listener is listening on
D_WEB_REMOTE_IP_ADDR -
D_WEB_REMOTE_IP_PORT -
DC_CAMPAIGN - Donation Campaign name
DC_SEQ - Donation Campaign number
F_WEBPAGE_PASSWORD - Password for patron
FC_SEQ - Internal number on this Code Table
FC_RESULT1_NAME - Code Table value
FC_RESULT2_NAME - Code Table value
I_LOCAL_IP_ADDR -
M_PURCHASE_AMOUNT - Amount for which the membership/pass/gift certificate will be purchased for
MS_SECTION - Section the seats are in
MS_ROW_NUMBER - Row the seats are in
MS_SEAT_NUMBER - Seat numbers
MT_SEQ - Membership/ Pass type number (not control number)
MT_DESCRIPTION - Membership/Pass Description
ORD_SEQ -
ORD_TIX_PRINT_STATUS -
ORD_NOTES - Any notes on an order
ORD_DATE_ENTERED - Date that an order was entered
P_SEQ - Event number (not event code)
P_PLAY_TITLE - Event title
PAY_AUTH_REF_NO - Authorization number on card payments
PAY_CARD_NO - Credit card number
PAY_CARD_EXPIRY - Credit card Expiry Date
PAY_METHOD_FC_SEQ -
PAY_TOTAL_PAID - Amount of the payment
PB_PERFORM_DATE - Performance Date
PB_PERFORM_TIME - Performance Time
PC_DESCRIPTION -Description of the Price Code
PM_SHORT_NAME - Mail List name
PS_QUANTITY - Quantity of tickets for Festival Seating
SC_DESCRIPTION - The description of the promotion code
SCD_DON_AMOUNT - If non-zero, the donation amount applied to a campaign
SCD_MAIL_FEE - The mailing fee for the shopping cart
SCD_MT_AMOUNT - The amount of the membership that the patron wishes to purchase
SCD_PROGRAM_NAME - The name that the patron wishes to use for this donation in the sponsor program
SCD_QUANTITY - This value is 1 for reserved seating and could be more for festival seating tickets and membership
SCD_SEQ - The shopping cart number that this purchase belongs to
SCH_DATE_CHECKOUT - The date that the patron proceeded to check out the purchased (i.e. completed it). if blank, it was never completed
SCH_DATE_ENTERED - The date that the patron began the internet purchase using his shopping cart
SCH_DATE_UPDATED - The latest date that the patron made a change to the shopping cart
SCH_TAX1 - The total of this tax type for all items in this shopping cart
SCH_TAX2 - The total of this tax type for all items in this shopping cart
SCH_TAX3 - The total of this tax type for all items in this shopping cart
SCH_TIX_QUANTITY - The total number of tickets in this shopping cart
SCH_TOTAL_COST - The total cost of the items in the shopping cart, including taxes
C:\Program Files\Apache Software Foundation\Apache 2.2
and on a Mac at:
Library\Apache2
It is worth noting that at minimum, the pages linked here will need edits in order to bring web sales online.
Clients using the Enterprise Edition of Theatre Manager generally only have a "1" folder. The "1" is the Outlet Number as defined in Company Preferences.
Those clients who have Outlet Edition will have a "1", "2", "3" (and so on) folder assigned to each outlet based on the number assigned to each in Company Preferences. This way, each company can have its own set of web pages customized however they'd like and selling their own merchandise.
|
Each company must have its own web listener. |
The pages beyond this folder mark the true beginning of the custom look of a client's online store.
Description:
Location:
htdocs/1
Able to Call Page(s):
Called By Page(s):
Description:
Location:
htdocs/1
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1
Able to Call Page(s):
Called By Page(s):
Description:
Location:
htdocs/1
Able to Call Page(s):
Called By Page(s):
Clients who wish to have multilingual pages will need to do four things:
|
After a patron picks their language, the next time they log in, Theatre Manager will recall and use their personal language preference. |
Description:
Questions and Answers:
Q: What needs to be done to setup the TMattendance.html page for tracking attendance in Theatre Manager?
A: The page only needs to be accessed in order to use the attendance tracking feature. For additional details on setting up the scanning process please click here.
____________________________________________________________
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Questions and Answers:
Q:
A:
____________________________________________________________
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Custom pages can be created for an event by duplicating the existing default page. The word Default in the page name is then replaced with the donation campaign number. The donation campaign number is located in the Seq # column under Setup >> System Tables >> Donation Campaigns in Theatre Manager. If this column is not visible simply right click on any of the column headers and select it. The column with then display in the list.
Description:
Location:
htdocs/1/WebPagesEN/tmCampaign
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmCampaign
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmCampaign
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Questions and Answers:
Q:
A:
____________________________________________________________
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Questions and Answers:
Q: Why are there no payment methods in the drop down list?
A: If your credit card payment methods do not appear in the drop down it may be the Merchant Account is not setup to be used online. In Theatre Manager go to Setup >> System Tables >> Merchant Accounts. Double click on the merchant account and ensure the By the Web Listener box is checked. Under the Cards tab in the merchant account double click on each card and ensure the Available At Internet box is checked. The card will also need a bullet in the Yes column for Authorize Via Credit Card Server.
____________________________________________________________
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmContent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmContent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmContent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmContent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmContent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmContent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmContent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmContent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmContent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmContent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmContent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmContent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmContent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmContent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
This folder will contain a copy of each web page customized for an organizations online tickets site that does not pertain to the tmGifs folder. Online sales will review the tmCustom folder prior to the default web pages. If a custom page is located the online sales will display the custom page over the default page. For more information please click here.
This folder contains customized copies of the default pages from within the WebPagesEN folder. These pages have been edited to meet the design and desired look for the organizations online sales. Each page contained within a sub-folder should be saved to the corresponding folder within the tmCustom folder. For details on the default WebPagesEN folder click here.
This folder contains customized copies of the default pages from within the tmCampaign folder. These pages have been edited to meet the design and desired look for the organizations online sales. For details on the default tmCampaign folder click here.
This folder contains customized copies of the default pages from within the tmContent folder. These pages have been edited to meet the design and desired look for the organizations online sales. For details on the default tmContent folder click here.
This folder contains customized copies of the default pages from within the tmEvent folder. These pages have been edited to meet the design and desired look for the organizations online sales. For details on the default tmEvent folder click here.
This folder contains customized copies of the default pages from within the tmFee folder. These pages have been edited to meet the design and desired look for the organizations online sales. For details on the default tmFee folder click here.
This folder contains customized copies of the default pages from within the tmMaps folder. These pages have been edited to meet the design and desired look for the organizations online sales. For details on the default tmMaps folder click here.
This folder contains customized copies of the default pages from within the tmPass folder. These pages have been edited to meet the design and desired look for the organizations online sales. For details on the default tmPass folder click here.
This folder contains customized copies of the default pages from within the tmScripts folder. These pages have been edited to meet the design and desired look for the organizations online sales. For details on the default tmScripts folder click here.
This folder contains customized copies of the default pages from within the tmSubscription folder. These pages have been edited to meet the design and desired look for the organizations online sales. For details on the default tmSubscription folder click here.
This folder contains customized copies of the default pages from within the TMtemplates folder. These pages have been edited to meet the design and desired look for the organizations online sales. For details on the default TMtemplates folder click here.
This folder contains customized copies of the default pages from within the tmVenue folder. These pages have been edited to meet the design and desired look for the organizations online sales. For details on the default tmVenue folder click here.
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Custom pages can be created for an event by duplicating the existing default page. The word Default in the page name is then replaced with the event number. The event number is located in the Event # column under Setup >> Events in Theatre Manager.
Description:
Location:
htdocs/1/WebPagesEN/tmEvent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmEvent
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Custom pages can be created for a fee by duplicating the existing default page. The word Default in the page name is then replaced with the fee sequence number. The fee number is located in the Fee # column under Setup >> System Tables >> Fee Types in Theatre Manager. If this column is not visible simply right click on any of the column headers and select Fee #. The column with then display in the list.
Description:
Location:
htdocs/1/WebPagesEN/tmFee
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmFee
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmFee
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmFee
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmFee
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmFee
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Questions and Answers:
Q: Can this page be updated such that the print at home tickets will contain organization-specific or other information?
A: Yes, it can. The page itself can be updated to contain whatever text a client wishes to include. Please note that this same page is used for all events, so event-specific information or similar will print on all tickets generated from this page.
____________________________________________________________
Q: Can I add a logo to the print at home tickets?
A: Yes, you can. Simplest way is to put the logo image file inside tmGifs and then include a link on this page to img src="tmGifs/sponsorLogo.jpg". Please note that any logo included here will print on every ticket, regardless of event. So a sponsor logo for one show only would print on every show's tickets.
____________________________________________________________
Q: Can I add colour or a background colour to the tickets?
A: Yes, you can. We originally chose to have the page print in black and white to make things easier on the end user (and their toner cartridge) but if you'd like the tickets to have colour, you can edit the stylePages.css file. The areas to edit are those that end in "print," ie, backgroundprint or tablerowdetailprint.
____________________________________________________________
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:




Questions and Answers:
Q: Why are the navigation buttons appearing in deep red on Internet Explorer, but are normal on other browsers?
A: When the line below is uncommented in the style sheets the buttons appear a graded red in an Internet Explorer browser.
filter:progid:DXiMageTransform.microsoft.Gradient(GradientType=0,StartColorStr='#ff800000',EndColorStr='#ff800000');
To comment out information within the style sheet add a /* at the beginning of the text and */ at the end of the text.
Q: I do most of my web development testing with Safari or Chrome as a web browser, and eventually I get around to checking things with Internet Explorer. What I am seeing with our ticketing site is two vastly different color schemes. Is there a separate set of .css files or something that pertains specifically to Internet Explorer, or are they just different from the Mac browsers?
A: In part, this has to do with the color calibration of the monitor the patron is using to view your site. You can change the color calibration for your monitors - which is especially easy on a Mac. While Mac has color correction set up for your monitor, your browser may or may not use color correction for web content/images depending on its setup. Your color picker reports what your Operating System thinks it is rendering. Another browser may report something else.
Most Mac browsers (Safari, Firefox) use color management to display what is theoretically True Color. This means that it will read the colors that are embedded in original web page or image, match them to the color calibration of your monitor and display them appropriately. Unmanaged browsers (such as Internet Explorer) do not read the embedded color coding and apply colors according to a default set in a color palette - which may or may not match what the original web page designer intended.
So while this is not a solution, it is an explanation. The images and web page elements are being sent identically to all browsers. The various browsers, however, are interpreting the color palette differently. Safari and Firefox offer color calibration to your monitor. Other browsers may not.
Location:
htdocs/1/WebPagesEN/tmGifs/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
















Location:
WebPagesEN/tmGifs/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
![]() |
.background | Indicates the colour, image and attributes to be used for the background in most web pages within the online sales. |
| .backgroundPrint | The colour to be used as the background for print pages from within the web sales. | |
| .backgroundSide | The colour used for the tmnavSide.html page. When using frames, this attribute can be edited to meet the design requirements for the side panels. | |
| .backgroundSidePrint | The colour of the side panels, when printed, while using frames within the web pages. | |
| .limitedprofilelogin | Allows for the over all customization of the TMpatronLimitedProfile.html page. | |
| .limitedprofileentry | The customization of the entry fields within the TMpatronLimitedProfile.html page | |
![]() |
.main | A text style mainly included within <P> tags in the web pages. Sets the font size and colour of text within a web page. |
| .mainPrint | The text colour for print pages from within the web sales. | |
| .title | The header of the page that often appears at the top of the browser window. | |
| .titlePrint | Header for print pages from within the web sales. | |
![]() |
a.navlink | Attributes for the navigation links within the tmnavSide.html pages. It is also used in the TMattendancePalm.html page |
![]() |
a.navlinkPrint | The attributes of a.navlink when printed. |
| a.navlink:hover | The result of a mouse moving over a hyperlink in the tmnavSide.html page. | |
| a.navlinkPrint:hover | The attributes of a.navlink:hover when a mouse is on top of it at the time the page is printed. | |
![]() |
.message | The text pulled from the TMError.txt page. This text is found across the top of the web page. |
![]() |
.messagePrint | The attributes of .message when printed. |
![]() |
.waitmessage | This message appears on web pages where it make take a moment for the request to return with information from the database. |
![]() |
a.link | An <A HREF> style for links within the web pages. |
![]() |
a.linkPrint | The attributes of a.link when printed. |
| a.link:hover | The result of a mouse moving over the a.link hyperlink in the web pages. | |
| a.linkPrint:hover | The attributes of a.link:hover when a mouse is on top of it at the time the page is printed. | |
![]() |
.playinfo | The text within the season or ticket sales process that describes the performance details. |
![]() |
.playinfoPrint | The attributes of a.playinfo when printed. |
| .backgroundBottom | The colour used for the tmnavBottom.html page. When using frames, this attribute can be edited to meet the design requirements for the bottom panels. | |
| .backgroundBottomPrint | The colour of the bottom panels, when printed, while using frames within the web pages. | |
![]() |
.tablerowheader | Descriptive information within the tables of the web pages. |
![]() |
.tablerowheaderprint | The attributes of .tablerowheader when printed. |
![]() |
.tablerowdetail | Active information within the tables of the web pages. |
| .tablerowdetailprint | The attributes of .tablerowdetail when printed. | |
![]() |
.calendarheader | Future Implementation. |
| .calendarcellheadercurrentmonth | Future Implementation. | |
| .calendcellheadercurrentdate | Future Implementation. | |
| .calendarcellheaderothermonth | Future Implementation. | |
| .calendarcellheaderotherdate | Future Implementation. | |
| table.inner | Future Implementation. | |
| table.outer | Future Implementation. | |
| table.calendar | Future Implementation. | |
| table.calendar a.link | Future Implementation. | |
| table.calendar a.link:hover | Future Implementation. | |
| .calendar2 | Future Implementation. | |
| table.calendar tr | Future Implementation. | |
| table.calendar td | Future Implementation. | |
| table.calendarother | Future Implementation. | |
| table.calendarother a.link | Future Implementation. | |
| table.calendarother a.link:hover | Future Implementation. | |
| table.calendarother tr | Future Implementation. | |
| table.calendarother td | Future Implementation. | |
| table.datenumber | Future Implementation. | |
| table.datenumber tr | Future Implementation. | |
| table.datenumber td | Future Implementation. | |
| table.datenumber td#green | Future Implementation. | |
| table.datenumberother | Future Implementation. | |
| table.datenumberother tr | Future Implementation. | |
| table.datenumberother td | Future Implementation. | |
| table.datenumberother td#noborder | Future Implementation. |
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmGifs
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Custom pages can be created based on the venue by duplicating the existing default page. The word Default in the page name is then replaced with the map number. The map number is located in the Map # column under Setup >> Venue Maps in Theatre Manager.
There are three TMticketSection_MapDefault pages that look very similar. The page ending in a C is for courses. The page ending in a F is for festival seating or general admission performances. The page without an additional letter is for reserved seating performances. A custom page can be created for these three types of ticket sale and made specific to the venue.
Description:
Location:
htdocs/1/WebPagesEN/tmMaps
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmMaps
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Questions and Answers:
Q:How can the Pricing drop down order be altered?
A: The pricing drop down is sorted in descending order based on highest price to lowest price. The promotion external description will determine the sort if there are two or more price points of the same value. Promotions sort in ascending order. For steps on how to access the sales promotion click here. Please note not all Promotions or Price Codes are available online and altering promotions will only need to be done for those options that appear online.
____________________________________________________________
Q: How do you remove the price code name from the Pricing drop down?
A: Select the Web Options tab under Setup >> Company Preferences in Theatre Manager. Remove the check from the Show Price Code option in the Permitted Ticket Printing Options section of the page. Clear the cache on the web listener for the change to take effect. For detailed steps on how to clear the cache in Theatre Manager click here.
____________________________________________________________
Q: How do you remove the Promotion from the Pricing drop down?
A: Select the Web Options tab under Setup >> Company Preferences in Theatre Manager. Remove the check from the Show Sales Promotion option in the Permitted Ticket Printing Options section of the page. Clear the cache on the web listener for the change to take effect. For detailed steps on how to clear the cache in Theatre Manager click here.
____________________________________________________________
Location:
htdocs/1/WebPagesEN/tmMaps
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmMaps
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmMaps
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Questions and Answers:
Q: How can the Pricing drop down order be altered?
A: The pricing drop down is sorted in descending order based on highest price to lowest price. The promotion external description will determine the sort if there are two or more price points of the same value. Promotions sort in ascending order. For steps on how to access the sales promotion click here. Please note not all Promotions or Price Codes are available online and altering promotions will only need to be done for those options that appear online.
____________________________________________________________
Q: How do you remove the price code name from the Pricing drop down?
A: Select the Web Options tab under Setup >> Company Preferences in Theatre Manager. Remove the check from the Show Price Code option in the Permitted Ticket Printing Options section of the page. Clear the cache on the web listener for the change to take effect. For detailed steps on how to clear the cache in Theatre Manager click here.
____________________________________________________________
Q: How do you remove the Promotion from the Pricing drop down?
A: Select the Web Options tab under Setup >> Company Preferences in Theatre Manager. Remove the check from the Show Sales Promotion option in the Permitted Ticket Printing Options section of the page. Clear the cache on the web listener for the change to take effect. For detailed steps on how to clear the cache in Theatre Manager click here.
____________________________________________________________
Q: How can I make the entire map display?
A: Change the selected_border value in the image reference near the bottom of the page to be 999.
____________________________________________________________
Q: How can I change the color the seats appear as on the map?
A: Change the selected_color in the image reference near the bottom of the page to the desired hex color value.
____________________________________________________________
Q: How do you change the map image at the bottom of the page so it does not display the image from within Theatre Manager?
A:Add the desired image to the tmGifs folder with the htdocs. Comment out the existing image reference line at the bottom of the page. Add a new image reference for the desired image. The full path name is not required. /tmGifs/image.jpg can be used ad this page is already referencing the htdocs through the base reference.
____________________________________________________________
Location:
htdocs/1/WebPagesEN/tmMaps
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmMaps
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmMaps
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmMaps
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Custom pages can be created for a pass by duplicating the existing default page. The word Default in the page name is then replaced with the pass type number. The pass type number is located in the Type # column under Setup >> System Tables >> Member Types in Theatre Manager. If this column is not visible simply right click on any of the column headers and select it. The column with then display in the list. Please note the word Member may have been altered in the database base for the organization.
Description:
Location:
htdocs/1/WebPagesEN/tmPass
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmPass
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmScripts
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmScripts
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/tmScripts
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Custom pages can be created for a season package by duplicating the existing default page. The word Default in the page name is then replaced with the season package number. The season package number is located in the Seq # column under Patron Sales >> Season Reservations >> Setup Season Packages in Theatre Manager.
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Questions and Answers:
Q: How can the mandatory fields be changed?
A: There are two steps. The first is the Asterisk can be removed from the field within this page. The second within Theatre Manager. Click Setup >> System Preferences. Select the Mandatory Data tab. Remove the checks from the Full Profile Patron Data fields as desired.
____________________________________________________________
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Questions and Answers:
Q:
A:
____________________________________________________________
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Questions and Answers:
Q:
A:
____________________________________________________________
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Questions and Answers:
Q: Where is the limited profile option enabled?
A: In Theatre Manager click Setup >> System Preferences. Select the Mandatory Data tab. Check the desired locations in the Allow Limited Profile Patron On section.
____________________________________________________________
Q: Where are the limited profile account settings in Theatre Manager?
A: In Theatre Manager click Setup >> System Preferences. Select the Mandatory Data tab. Place a check mark next to the desired fields for limited profile in the Limited Profile Web Sales Checkout Patron Data section.
____________________________________________________________
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Questions and Answers:
Q: How can the name of the package be changed?
A: In Theatre Manager go to Patron Sales >> Season Subscriptions >> Setup Season Packages. Double click on the desires season package. Alter the External Description field to display the name of the package as it should appear online.
____________________________________________________________
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Questions and Answers:
Q: Where can I edit the telephone number pulled in this message?
A: The telephone number is pulled from the Theatre Manager database. It's located in the Company tab of Setup >> Company Preferences.
____________________________________________________________
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Questions and Answers:
Q: How can the Availability percentages be altered?
A: Each option (Good, Limited, Very Limited, Sold Out) are indicated based on the percentage of seats sold within the Theatre Manager database compared to the Reporting Capacity listed for the individual performance. The percent values are listed on the page in the F_SOLD_PERCENT statements and can be altered to meet the organizations needs.
____________________________________________________________
Q:How are the colors used in the Availability column altered?
A: Each option is listed following a font color. Altering the hex code associated with the font color will change the color of the text.
____________________________________________________________
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN/TMtemplates/
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:

Description:
Questions and Answers:
Q: How can the Availability options column be changed?
A: The text in the Availability column is located in the rowTicketsEvent.html page. By accessing this template the percentage level for availability can be altered. In addition the colour of the text and the wording can be altered as desired.
____________________________________________________________
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Questions and Answers:
Q: How can I export event details from this page?
A: Please click here for details on how to export event data.
____________________________________________________________
Q: What if I want to change the information to be exported from this page?
A: To details on how to alter information in an export please click here.
____________________________________________________________
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Questions and Answers:
Q: How can I export event details from this page?
A: Please click here for details on how to export event data.
____________________________________________________________
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Custom pages can be created for a venue by duplicating the existing default page. The word Default in the page name is then replaced with the map number. The map number is located in the Map # column under Setup >> Theatre Maps in Theatre Manager.
Description:
Location:
htdocs/1/WebPagesEN/tmVenue
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
Location:
htdocs/1/WebPagesEN
Able to Call Page(s):
Called By Page(s):
Page(s) Referenced:
Description:
The following files in the htdocs folder are all variations on the Powered By Apache logo:
Location:
htdocs
Able to Call Page(s):
Called By Page(s):
Description:
Location:
htdocs
Able to Call Page(s):
Called By Page(s):
Description:
Location:
htdocs
Able to Call Page(s):
Called By Page(s):
Description:
Location:
htdocs
Able to Call Page(s):
Called By Page(s):
Description:
Location:
htdocs
Able to Call Page(s):
Called By Page(s):
Description:
Location:
htdocs
Able to Call Page(s):
Called By Page(s):
Description:
Location:
htdocs
Able to Call Page(s):
Called By Page(s):
While these web pages contain all the functionality, many venues like to change the look of the web pages to 'brand' the pages in their own image. To brand a site, the recommended steps are below. We recommend making a minimum of changes to the pages as it means that you can upgrade pages when we add future functionality quite easily. This is possible because we have tried to isolate the required changes to a few files at most. In practice, this works out very well.
The general approach to branding the web site is:
If you do want to change a page, copy that page into the same location in the WebPagesEN/tmCustom folder and make the changes to the COPY. Theatre Manager will reference the tmCustom folder first and use the page there, if it finds one.
Try to minimize changes to pages as it affects ability to upgrade pages later on.
Before anything can be changed, you need to know where the web pages are. They are always installed in the HTDOCS folder of the apache server that is set up when Theatre Manager is first installed. If you need remote access to this folder, you may need to set up an FTP server or File Sharing to the HTDOCS folder, or simply do the work on the apache machine. (Talk to your IT person if you need to set up access via something like Filezilla).
The Web Sales Modules is comprised of a number of different pages, such as, the content pages, login page, shopping cart and checkout pages to name a few. To change the pages to be specific to your venue, your web developer/designer will need to edit the appropriate pages.
The links on the side navigation beginning here, will guide you through the pages in the Web Sales Module and give you detailed information on how each web page is used by module.
You can alter the source code of the Web Sales pages to suit your needs. However, if you do, Arts Management Systems is not responsible for supporting or debugging errors that may occur.
|
Please ensure you have a backup of the web pages prior to make changes. |
Throughout this section of the help, you will see
|
Programmer's Note: These notes provide the web developer/designer with further information on how to customize the web pages. |
|
Programmer's Note: Remember that changing the name of any of the html files that come with the Web Sales Module will require you to check that any pages that link to the new renamed page has been revised to accomodate for that change. Otherwise you will have broken links or errors on your pages |
You are free to edit additional pages if you choose. However, a couple of caveats:
Other than those general rules, open any page with your favorite page editor and make changes as you like. The pages that we find venues change most often are:
The files that you want to change can be found within the HTDOCS folder. Look for a folder with a number on it (for most sites it will be '1' - this represents the outlet in a multi company version of Theatre Manager). Look for a folder called WebPagesEN and inside that, for tmGifs. This will be the base folder for the remainder of this section. The files to change are:
There are two style sheet files within the tmGifs folder. By altering them, you can change most of the look of Theatre Manager web sales. Specifically, change styleButtons.css to change the look of the buttons at the top of the page and stylePages.css to change the look of the tables, text, error messages, buttons, etc. within each page.
There are some files like pageHeader.gif. Make replacement files for those that contain your header or how you want the top of each page look. If you prefer a different look for the numbers in steps, or the handicapped logo there are some other .gif files within this folder that you may want to change . Make your image, save the image with the same name as the one in the tmGifs folder (ensure you match the case), replace the existing file in the tmGifs folder, and you will have a new look to your page
The kinds of changes that fall into this category and involve no web design work are:
These kinds of changes are simple text changes to various data fields within Theatre Manager or changes to options in the Company Preferences area. Most do not require any changes by a web designer as they are daily operational aspects of TM.
|
It is possible to add some html tags to some of the large descriptive fields like the event description. If there are html tags in those fields, you can have additional control over the display of text. eg, you can include <b><em><a><img> type tags very easily to create a desired look without changing pages. |
Specifically, this help page focuses on the three options on the right side of the Web Options tab.

There is a hierarchy to how the permitted web ticketing options work.
If you do not allow a mail fee in the company preferences, then the 'Mail to Patron' button will not be available online. The default behavior of the pages is to hide the button.
So, in the case of 'no mail fee allowed', then there are two remaining options in Company Preferences:
If you check 'Print at home' for tickets, bar codes will be printed for events/performances for later scanning when the patron arrives at the venue - But only for the performances where 'Print at home' is also enabled. This implies that you may chose to let people print bar code on some events and not others.
If bar codes can be printed for an event, the tickets are marked as printed in Theatre Manager, regardless. Therefore, when you do a batch print of unprinted tickets, the print at home tickets will never be included in the batch print. 'Hold for Will Call' has NO meaning in that context because the customer has already got tickets with bar codes on them.
If bar codes are not allowed on an event, then those tickets are not marked as printed. That, in essence, defaults into 'hold for willcall' (but only the tickets that had no barcode).
In the case where 'Mail to patron' is checked, then all other options are ignored, regardless of setting (i.e. "mail me tickets, plus I'll also print the bar code for those tickets" simply doesn't make sense).
Taking it a step further, if mail to patron is not enabled and print at home is not enabled, then the only choice is 'Hold for Will Call'.
The following are examples of what a few our of the hundreds of venues using Theatre Manager have done to the sample web pages. It gives you an idea that the sky can be the limit and a fair degree of personal branding is very possible very quickly.
Make sure and click on the 'tickets' buttons on these sites.
Each client is provided the standard web pages designed by Arts Management Systems. Some organizations choose to make minor adjustments to they style sheets in order to reflect their default homepage. Others choose a more customized design of the pages. Examples of customized pages can be found on the Sample Web Sites page.
Below you will find some examples other sites have used in their customization process. These examples can be used to create a more personal feel to your web site. If you are not familiar with html we would strongly recommend contacting your web designer for assistance.
Redirecting the Add Code button for Coupons and Pre-Access Codes
When entering a coupon code in the online sales the patron clicks the Add Code button. This button appears in the TMtickets.html and TMcart.html pages. The button accepts the coupon or access code and returns the patron to the TMtickets.html page.
<tr>
<td align="right">Presale Access Code</td>
<td><input name="CH_CODE" type=text id="CH_CODE" value="<field>CH_CODE</field>" size=40 maxlength=40 onBlur="this.value=this.value.toUpperCase()">
</td>
<td align="left"><input name="btnCouponAccept" type=submit class="new" onMouseOver="pviiClassNew(this,'newover')" onMouseOut="pviiClassNew(this,'new')" value="Add Code" onClick="process()">
<input name='param' type='hidden' value ='altbtn=btnTicket'>
</td>
</tr>
Adding Anchors to a page
When adding anchors it's important to comment out the F_HTML_IMAGE_SERVER reference at the top of the page. This means the reference will needed to be added directly to any images within the pages and the style sheet lines in order for them to appear. They would look something like this:
href="<field>F_HTML_IMAGE_SERVER</field>tmGifs/styleButtons.css"
href="<field>F_HTML_IMAGE_SERVER</field>tmGifs/stylePages.css"
The link and reference to an anchor must fall outside of a Table. Additional items can be added to the link such as a class reference to the style sheets that will determine the attributes of the link. The link would look something like:
<a class="link" href="#gc">Gift Certificates</a>
The anchor would look something like this:
<h3 id="gc">Gift Certificates</h3>
Adding a Direct Purchase Button for a Donation
The lines below are an example of a donation button with a fixed value. Clicking on the button will add a donation to the online cart for the value hidden within the button. The donation campaign is also specified within the button. This code can be added to any page within the online sales. It would most commonly appear within a customized TMdonation.html page or a TMcart.html page.
<FORM ACTION="<field>F_HTML_FIREWALL</field>online" METHOD=POST>
<input name="btnDonationAccept" type=submit value="YES! Add $2 for SPAC's Classical Kids Program sponsored by Union College" class="new" onMouseOver="pviiClassNew(this,'newover')" onMouseOut="pviiClassNew(this,'new')" onClick="process()">
<input type="hidden" id="DD_DC_SEQ" name="DD_DC_SEQ" value="59">
<input type="hidden" id="DD_AMOUNT_PLEDGE" name="DD_AMOUNT_PLEDGE" value="25">
</form>
Adding a Direct Purchase Button for a Member Type
The lines below are an example of a button that will add a specific member type to the cart with a fixed value and quantity. This button can be added to any page within the online sales. It would most commonly appear on the TMpass.html page or the TMcart.html page.
<FORM ACTION="<field>F_HTML_FIREWALL</field>online" METHOD=POST>
<input name="btnReservePass" type=submit value="Purchase Youth Golfer - $100" class="new" onMouseOver="pviiClassNew(this,'newover')" onMouseOut="pviiClassNew(this,'new')" onClick="process()">
<label for="Membership"><strong> Golfers Name </strong> </label>
<input type="hidden" name="MT_SEQ" value="23">
<input type="hidden" name="PS_QUANTITY" value="1">
<textarea name="M_NOTES" cols="49" rows="1"><field>M_NOTES</field></textarea>
</form>
Adding a Purchase Option for a Specific Member Type
The lines below are an example of a button that will add a specific member type to the cart with a fixed value. This button can be added to any page within the online sales. It would most commonly appear on the TMpass.html page or the TMcart.html page.
<TABLE width="345" BORDER=0 CELLPADDING=1>
<TR>
<TD WIDTH=92 class="tablerowheader" align="center">
<P align="right">Type</P>
</TD>
<TD width="240" class="tablerowheader">
<FORM ACTION="<field>F_HTML_FIREWALL</field>online" METHOD=POST><DIV ALIGN="center">
<label for="Team"><strong>Gift Certificates</strong> </label>
<input type="hidden" name="MT_SEQ" value="14">
</DIV>
</TD>
<TR>
<TD WIDTH=92 class="tablerowheader">
<P align="right">Quantity</P>
</TD>
<TD class="tablerowdetail">
<select name="PS_QUANTITY" size="1" id="PS_QUANTITY">
<option value="1" selected>1</option>
<option value="2">2</option>
<option value="3">3</option>
</select>
</TD>
</TR>
<TR>
<TD valign="top" class="tablerowheader" align="right">Personalized Message</TD>
<TD class="tablerowdetail" align="left">
<textarea name="M_NOTES" cols="50" rows="5"><field>M_NOTES</field></textarea>
</TD>
</TR>
<tr class="tablerowheader">
<td colspan=2 align="center">
<input name="btnReservePass" type=submit value="Add Gift Certificate to Shopping Cart" class="new" onMouseOver="pviiClassNew(this,'newover')" onMouseOut="pviiClassNew(this,'new')" onClick="process()">
</FORM>
</TD>
</TR>
</TABLE>
Adding a Button to Apply a Specific Coupon Code
The lines below are an example of how to create a button that will apply a specific Coupon Code to the online cart. This button can be added to any page within the online sales. It would most commonly appear on the TMtickets.html page or the TMcart.html page.
<tr>
<td>input name="btnCouponAccept" type=submit class="new" id="CH_CODE" onMouseOut="pviiClassNew(this,'new')" value="Special Promotion Button" onClick="process()">
<td>input type="hidden" id="CH_CODE" name="CH_CODE" value="1234">
<td>input name='param' type='hidden' value ='altbtn=btnTicket'>
</td>
</tr>
Eliminating the Price Code Drop Down
The html code below will provide a single option for pricing rather the the price code drop down list that is currently a part of the online sale pages. This text most commonly would effect the TMticketsPrice_MapDefault.html and TMsubscriptionPriceMapDefault.html pages.
<input name=SC_DESCRIPTION type=hidden value="<field>F_HTML_PROMOTIONS_LIST.1.SC_SEQ</field>:
<field>F_HTML_PROMOTIONS_LIST.1.PC_SEQ</field>:
<field>F_HTML_PROMOTIONS_LIST.1.SCD_ORIGINAL_SC_SEQ</field>:
<field>F_HTML_PROMOTIONS_LIST.1.SCD_ORIGINAL_PRICE_CODE</field>:
<field>F_HTML_PROMOTIONS_LIST.1.SCD_SAVINGS</field>"
<field>F_HTML_SELECTED</field>>
<field>pick(D_WEB_SHOW_PROMOTION,'',con(F_HTML_PROMOTIONS_LIST.1.SC_DESCRIPTION,' '))</field>
<field>pick(D_WEB_SHOW_PRICE_CODE,'',con(F_HTML_PROMOTIONS_LIST.1.PC_DESCRIPTION,' '))</field>$<field>F_HTML_PROMOTIONS_LIST.1.PS_TOTAL_COST</field>
The sample source for a web page footer can be pasted into Theatre Manager in Setup >> Company Preferences. The footer is added to each page within the default web pages. You will need to sign up to get a U-XXXXX-X number that will replace the value in the sample code.
Once you have this set up in Theatre Manager, you can also include it in your eblasts. Analyzing the statistics occurs by logging in to the Google Analytics Login Page.
You can also track the direct source of why a cart was created using the &tmsource=yyy tag.
Additionally, there is a provision in Theatre Manager's word processor to add the Google Analytics code from the Web Listener Tab to a Form Letter, which can then be used as an Eblast to patrons in the database. For general information on how to create a Form Letter in Theatre Manager, click here. To add the Google Analytics code to a letter:
Once the letter has been emailed to patrons, the same sort of analysis that can be done with web pages can be done for your eblast. For more information on setting up for an eblast from within Theatre Manager, click here.
The PCI Security Council supplies a document to merchants that provides a Prioritized Approach to PCI compliance. This document is quite good because it breaks down the standards into 6 milestones - what to do first, what to do second, etc. according to what will have the biggest impact in safeguarding your customer data.
Following the document and this index should help you address that most important PCI implementation standards quickly.
Source: PCI Prioritized Approach
Firewalls are devices that control computer traffic allowed into and out of an organization’s network, and into sensitive areas within its internal network. Routers are hardware or software that connects two or more networks.
| Section | PCI Requirement | Comments |
| 1.1 | Establish firewall and router configuration standards that formalize testing whenever configurations change; that identify all connections to cardholder data (including wireless); that use various technical settings for each implementation; and stipulate a review of configuration rule sets at least every six months. | |
| 1.1.1 |
A formal process for approving and testing all network connections and changes to the firewall and router configurations |
|
| 1.1.2 | Current network diagram with all connections to cardholder data, including any wireless networks |
Refer to Recommended Layout and adapt as neccessary |
| 1.1.3 | Requirements for a firewall at each Internet connection and between any demilitarized zone (DMZ) and the internal network zone | |
| 1.1.4 | Description of groups, roles, and responsibilities for logical management of network components | |
| 1.1.5 | Documentation and business justification for use of all services, protocols, and ports allowed, including documentation of security features implemented for those protocols considered to be insecure | |
| 1.1.6 | Requirement to review firewall and router rule sets at least every six months | |
| 1.2 | Build a firewall configuration that denies all traffic from "untrusted" networks and hosts, except for protocols necessary for the cardholder data environment. | Firewall rules |
| 1.2.1 | Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment. |
|
| 1.2.2 | Secure and synchronize router configuration files. |
|
| 1.2.3 | Install perimeter firewalls between any wireless networks and the cardholder data environment, and configure these firewalls to deny or control (if such traffic is necessary for business purposes) any traffic from the wireless environment into the cardholder data environment. | refer to venue lan setup |
| 1.3 | Prohibit direct public access between the Internet and any system component in the cardholder data environment. | |
| 1.3.1 | Implement a DMZ to limit inbound and outbound traffic to only protocols that are necessary for the cardholder data environment. | |
| 1.3.2 | Limit inbound Internet traffic to IP addresses within the DMZ. | |
| 1.3.3 | Do not allow any direct routes inbound or outbound for traffic between the Internet and the cardholder data environment. | |
| 1.3.4 | Do not allow internal addresses to pass from the Internet into the DMZ. | |
| 1.3.5 | Restrict outbound traffic from the cardholder data environment to the Internet such that outbound traffic can only access IP addresses within the DMZ. | |
| 1.3.6 | Implement stateful inspection, also known as dynamic packet filtering. (That is, only "established" connections are allowed into the network.) | |
| 1.3.7 | Place the database in an internal network zone, segregated from the DMZ. | |
| 1.3.8 | Implement IP masquerading to prevent internal addresses from being translated and revealed on the Internet, using RFC 1918 address space. Use network address translation (NAT) technologies—for example, port address translation (PAT). | |
| 1.4 | Install personal firewall software on any mobile and/or employee-owned computers with direct connectivity to the Internet that are used to access the organization's network. | May be required when Updating TM |
The easiest way for a hacker to access your internal network is to try default passwords or exploits based on default system software settings in your payment card infrastructure. Far too often, merchants do not change default passwords or settings upon deployment. This is akin to leaving your store physically unlocked when you go home for the night. Default passwords and settings for most network devices are widely known. This information, combined with hacker tools that show what devices are on your network can make unauthorized entry a simple task – if you have failed to change the defaults.
| Section | PCI Requirement | Comments |
| 2.1 | Always change vendor-supplied defaults before installing a system on the network. This includes wireless devices that are connected to the cardholder data environment or are used to transmit cardholder data. | change vendor supplied passwords |
| 2.1.1 | For wireless environments connected to the cardholder data environment or transmitting cardholder data, change wireless vendor defaults, including but not limited to default wireless encryption keys, passwords, and SNMP community strings. Ensure wireless device security settings are enabled for strong encryption technology for authentication and transmission. | refer to venue lan setup |
| 2.2 | Develop configuration standards for all system components that address all known security vulnerabilities and are consistent with industry-accepted definitions. | |
| 2.3 | Encrypt all non-console administrative access such as browser/Web-based management tools. | Theatre manager does not provide web management tools. Use RDC or equivalent internally for remote access management. |
| 2.2.1 | Implement only one primary function per server |
|
| 2.2.2 | Disable all unnecessary and insecure services and protocols (services and protocols not directly needed to perform the device's specified function). | refer to Disable SNMP service on Practical Automation Ticket Printers |
| 2.2.3 | Configure system security parameters to prevent misuse | |
| 2.2.4 | Remove all unnecessary functionality, such as scripts, drivers, features, subsystems, file systems, and unnecessary Web servers. | |
| 2.4 | Shared hosting providers must protect each entity's hosted environment and cardholder data (details are in PCI DSS Appendix A: "Additional PCI DSS Requirements for Shared Hosting Providers.") |
In general, no cardholder data should ever be stored unless it's necessary to meet the needs of the business. Sensitive data on the magnetic stripe or chip must never be stored. If your organization stores PAN, it is crucial to render it unreadable (see 3.4, and table below for guidelines).
| Section | PCI Requirement | Comments |
| 3.1 | Limit cardholder data storage and retention time to that required for business, legal, and/or regulatory purposes, as documented in your data retention policy. | Theatre Manager offers a shredding capability as well as option of meeting schedule C or D compliance |
| 3.2 | Do not store sensitive authentication data after authorization (even if it is encrypted). See guidelines in table below. | |
| 3.3 | Mask PAN when displayed; the first six and last four digits are the maximum number of digits you may display. Not applicable for authorized people with a legitimate business need to see the full PAN. Does not supersede stricter requirements in place for displays of cardholder data such as on a point-of-sale receipt. | Refer to PCI compliance statement on PAN etc. |
| 3.2.1 | Do not store the full contents of any track from the magnetic stripe (located on the back of a card, contained in a chip, or elsewhere). This data is alternatively called full track, track, track 1, track 2, and magnetic-stripe data. |
|
| 3.2.2 | Do not store the card-verification code or value (three-digit or four- digit number printed on the front or back of a payment card) used to verify card-not-present transactions | |
| 3.2.3 | Do not store the personal identification number (PIN) or the encrypted PIN block. | |
| 3.4 | Render PAN, at minimum, unreadable anywhere it is stored (including on portable digital media, backup media, in logs) by using any of the following approaches:
|
|
| 3.4.1 | If disk encryption is used (rather than file- or column-level database encryption), logical access must be managed independently of native operating system access control mechanisms (for example, by not using local user account databases). Decryption keys must not be tied to user accounts. | Theatre Manager does not use Disk Encryption. It uses field level encryption for data. |
| 3.5 | Protect cryptographic keys used for encryption of cardholder data from disclosure and misuse. | Theatre Manager handles creation and hiding of keys automatically. |
| 3.5.1 | Restrict access to cryptographic keys to the fewest number of custodians necessary |
|
| 3.5.2 | Store cryptographic keys securely in the fewest possible locations and forms | |
| 3.6 | Fully document and implement all appropriate key management processes and procedures for cryptographic keys used for encryption of cardholder data. | refer to re-encryption of credit cards for discussion on keys, generation and re-encryption. An upgrade will automatically perform this process if more than 350 days have elapsed since last re-encrption. Split 'knolwedge' of the keys is achieved by bringing together a key generated programatically and another portion generated by the customers interfacing with the key creation screen in system preferences. Both keys are required to generate the final encryption key. Arts Management never has knowledge of the customers portion of the key. The customer never knows the value of any key. |
| 3.6.1 | Generation of strong cryptographic keys | |
| 3.6.2 | Secure cryptographic key distribution | |
| 3.6.2 | Secure cryptographic key storage | |
| 3.6.4 | Periodic cryptographic key changes
|
|
| 3.6.5 | Retirement or replacement of old or suspected compromised cryptographic keys | |
| 3.6.6 | Split knowledge and establishment of dual control of cryptographic keys | |
| 3.6.7 | Prevention of unauthorized substitution of cryptographic keys | |
| 3.6.8 | Requirement for cryptographic key custodians to sign a form stating that they understand and accept their key-custodian responsibilities | Customer should have a form signed by the people/person responsible for key management that they reset the key once a year at a minimum or when suspected compromise occurs. Note it will be changed automatically on you during an upgrade if Theatre Manager detects it hasn't been changed for 350 days. |

Cyber criminals may be able to intercept transmissions of cardholder data over open, public networks so it is important to prevent their ability to view these data. Encryption is a technology used to render transmitted data unreadable by any unauthorized person.
| Section | PCI Requirement | Comments |
| 4.1 | Use strong cryptography and security protocols such as SSL/TLS or IPSEC 2 to safeguard sensitive cardholder data during transmission over open, public networks. |
See PC Charge and Orbital |
| 4.1.1 | Ensure wireless networks transmitting cardholder data or connected 2 to the cardholder data environment, use industry best practices ( e.g., IEEE 802.11i) to implement strong encryption for authentication and transmission.
|
refer to venue lan setup |
| 4.2 | Never send unencrypted PANs by end-user messaging technologies (for 2 example, e-mail, instant messaging, chat). | see link |
Many vulnerabilities and malicious viruses enter the network via employees’ e-mail and other online activities. Anti-virus software must be used on all systems affected by malware to protect systems from current and evolving malicious software threats.
| Section | PCI Requirement | Comments |
| 5.1 | Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers). |
See PostgreSQL Server and Apache Server and Workstations and Web Listeners and Remote Box Office |
| 5.1.1 | Ensure that all anti-virus programs are capable of detecting, removing, and protecting against all known types of malicious software. | |
| 5.2 | Ensure that all anti-virus mechanisms are current, actively running, and capable of generating audit logs. |
Security vulnerabilities in systems and applications may allow criminals to access PAN and other cardholder data. Many of these vulnerabilities are eliminated by installing vendor-provided security patches, which perform a quick-repair job for a specific piece of programming code. All critical systems must have the most recently released software patches to prevent exploitation. Organizations should apply patches to less-critical systems as soon as possible, based on a risk-based vulnerability management program. Secure coding practices for developing payments applications, change control procedures and other secure software development practices should always be followed.
| Section | PCI Requirement | Comments |
| 6.1 | Ensure that all system components and software have the latest vendor- supplied security patches installed. Install critical security patches within one month of release. |
|
| 6.2 | Establish a process to identify newly discovered security vulnerabilities (for example, subscribe to alert services freely available on the Internet). Update configuration standards as required by PCI DSS Requirement 2.2 to address new vulnerability issues. | |
| 6.3 | Develop software applications in accordance with PCI DSS (for example, secure authentication and logging) and based on industry best practices and incorporate information security throughout the software development life cycle. These processes must include the following: | |
| 6.3.1 | Testing of all security patches, and system and software configuration changes before deployment, including but not limited to the following: | |
| 6.3.1.1 | Validation of all input (to prevent cross-site scripting, injection flaws, malicious file execution, etc.) | |
| 6.3.1.2 | Validation of proper error handling | |
| 6.3.1.3 | Validation of secure cryptographic storage | |
| 6.3.1.4 | Validation of secure communications | |
| 6.3.1.5 | Validation of proper role-based access control (RBAC) | |
| 6.3.2 | Separate development/test, and production environments | |
| 6.3.3 | Separation of duties between development/test, and production environments | |
| 6.3.4 | Production data (live PANs) are not used for testing or development | |
| 6.3.5 | Removal of test data and accounts before production systems become active | |
| 6.3.6 | Removal of custom application accounts, usernames, and passwords before applications become active or are released to customers | |
| 6.3.7 | Review of custom code prior to release to production or customers in order to identify any potential coding vulnerability. | |
| 6.4 | Follow change control procedures for all changes to system components. The procedures must include the following: | |
| 6.4.1 | Documentation of impact | |
| 6.4.2 | Management sign-off by appropriate parties | |
| 6.4.3 | Testing of operational functionality | |
| 6.4.4 | Back-out procedures | |
| 6.5 | Develop all Web applications (internal and external, and including Web administrative access to application) based on secure coding guidelines such as the Open Web Application Security Project Guide. Cover prevention of common coding vulnerabilities in software development processes, to include the following: | |
| 6.5.1 | Cross-site scripting (XSS) | |
| 6.5.2 | Injection flaws, particularly SQL injection. Also consider LDAP and Xpath injection flaws as well as other injection flaws. | |
| 6.5.3 | Malicious file execution | |
| 6.5.4 | Insecure direct object references | |
| 6.5.5 | Cross-site request forgery (CSRF) | |
| 6.5.6 | Information leakage and improper error handling | |
| 6.5.7 | Broken authentication and session management | |
| 6.5.8 | Insecure cryptographic storage | |
| 6.5.9 | Insecure communications | |
| 6.5.10 | Failure to restrict URL access | |
| 6.6 | For public-facing Web applications, address new threats and vulnerabilities on an ongoing basis and ensure these applications are protected against known attacks by either of the following methods:
|
To ensure critical data can only be accessed by authorized personnel, systems and processes must be in place to limit access based on need-to-know and according to job responsibilities. Need-to-know is when access rights are granted to only the least amount of data and privileges needed to perform a job.
| Section | PCI Requirement | Comments |
| 7.1 | Limit access to system components and cardholder data to only those individuals whose job requires such access. |
|
| 7.1.1 | Restriction of access rights to privileged user IDs to least privileges necessary to perform job responsibilities | |
| 7.1.2 | Assignment of privileges is based on individual personnel's job classification and function | |
| 7.1.3 | Requirement for an authorization form signed by management that specifies required privileges | |
| 7.1.4 | Implementation of an automated access control system | |
| 7.2 | Establish an access control system for systems components with multiple users that restricts access based on a user's need-to-know, and is set to "deny all" unless specifically allowed | |
| 7.2.1 | Coverage of all system components |
Refer to employee settings and function access for credit cards |
| 7.2.2 | Assignment of privileges to individuals based on job classification and function |
|
| 7.2.3 | Default "deny-all" setting |
Assigning a unique identification (ID) to each person with access ensures that actions taken on critical data and systems are performed by, and can be traced to, known and authorized users.
| Section | PCI Requirement | Comments |
| 8.1 | Assign all users a unique user name before allowing them to access system components or cardholder data. | |
| 8.2 | Employ at least one of these to authenticate all users: password or passphrase; or two-factor authentication (e.g., token devices, smart cards, biometrics, public keys). | |
| 8.3 | Implement two-factor authentication for remote access to the network by employees, administrators, and third parties. Use technologies such as remote authentication and dial- in service or terminal access controller access control system with tokens; or virtual private network with individual certificates. | |
| 8.4 | Render all passwords unreadable for all system components both in storage and during transmission using strong cryptography based on approved standards | |
| 8.5 | Ensure proper user authentication and password management for non-consumer users and administrators on all system components. | Theatre Manager implements PCI standards. You may need a manual process for other applications or hardware. |
| 8.5.1 | Control addition, deletion, and modification of user IDs, credentials, and other identifier objects | |
| 8.5.2 | Verify user identity before performing password resets. | |
| 8.5.3 | Set first-time passwords to a unique value for each user and change immediately after the first use. | |
| 8.5.4 | Immediately revoke access for any terminated users. | |
| 8.5.5 | Remove/disable inactive user accounts at least every 90 days. | |
| 8.5.6 | Enable accounts used by vendors for remote maintenance only during the time period needed. | |
| 8.5.7 | Communicate password procedures and policies to all users who have access to cardholder data. | |
| 8.5.8 | Do not use group, shared, or generic accounts and passwords. | |
| 8.5.9 | Change user passwords at least every 90 days. | |
| 8.5.10 | Require a minimum password length of at least seven characters. | |
| 8.5.11 | Use passwords containing both numeric and alphabetic characters. | |
| 8.5.12 | Do not allow an individual to submit a new password that is the same as any of the last four passwords he or she has used. | |
| 8.5.13 | Limit repeated access attempts by locking out the user ID after not more than six attempts. | |
| 8.5.14 | Set the lockout duration to a minimum of 30 minutes or until administrator enables the user ID. | |
| 8.5.15 | If a session has been idle for more than 15 minutes, require the user to re-enter the password to re-activate the terminal | |
| 8.5.16 | Authenticate all access to any database containing cardholder data. This includes access by applications, administrators, and all other users. |
Any physical access to data or systems that house cardholder data provides the opportunity for persons to access and/or remove devices, data, systems or hardcopies, and should be appropriately restricted.
| Section | PCI Requirement | Comments |
| 9.1 | Use appropriate facility entry controls to limit and monitor physical access to systems in the cardholder data environment. |
|
| 9.1.1 | Use video cameras or other access control mechanisms to monitor individual physical access to sensitive areas. Review collected data and correlate with other entries. Store for at least three months, unless otherwise restricted by law. | |
| 9.1.2 | Restrict physical access to publicly accessible network jacks | |
| 9.1.3 | Restrict physical access to wireless access points, gateways, and handheld devices. | |
| 9.2 | Develop procedures to help all personnel easily distinguish between employees and visitors, especially in areas where cardholder data is accessible. | |
| 9.3 | Make sure all visitors are handled as follows: | |
| 9.3.1 | Authorized before entering areas where cardholder data is processed or maintained | |
| 9.3.2 | Given a physical token (for example, a badge or access device) that expires and that identifies the visitors as non-employees |
|
| 9.3.3 | Asked to surrender the physical token before leaving the facility or at the date of expiration | |
| 9.4 | Use a visitor log to maintain a physical audit trail of visitor information and activity. Retain the log for at least three months unless otherwise restricted by law. | |
| 9.5 | Store media back-ups in a secure location, preferably off site. | |
| 9.6 | Physically secure all paper and electronic media that contain cardholder data, including the following: | |
| 9.7 | Maintain strict control over the internal or external distribution of any kind of media that contains cardholder data. | |
| 9.7.1 | Classify the media so it can be identified as confidential. |
|
| 9.7.2 | Send the media by secured courier or other delivery method that can be accurately tracked. | |
| 9.8 | Ensure that management approves any and all media containing cardholder data moved from a secured area, especially when media is distributed to individuals. | |
| 9.9 | Maintain strict control over the storage and accessibility of media that contains cardholder data. | |
| 9.9.1 | Properly maintain inventory logs of all media and conduct media inventories at least annually. | |
| 9.10 | Destroy media containing cardholder data when it is no longer needed for business or legal reasons. | |
| 9.10.1 | Shred, incinerate, or pulp hardcopy materials so that cardholder data cannot be reconstructed. | |
| 9.10.2 | Render cardholder data on electronic media unrecoverable so that cardholder data cannot be reconstructed. |
Logging mechanisms and the ability to track user activities are critical for effective forensics and vulnerability management. The presence of logs in all environments allows thorough tracking and analysis if something goes wrong. Determining the cause of a compromise is very difficult without system activity logs.
| Section | PCI Requirement | Comments |
| 10.1 | Establish a process for linking all access to system components to each individual user – especially access done with administrative privileges. |
|
| 10.2 | Implement automated audit trails for all system components to reconstruct the following events: | refer to PCI audit Log settings |
| 10.2.1 | All individual accesses to cardholder data | |
| 10.2.2 | All actions taken by any individual with root or administrative privileges | |
| 10.2.3 | Access to all audit trails | |
| 10.2.4 | Invalid logical access attempts | |
| 10.2 5 | Use of identification and authentication mechanisms | |
| 10.2.6 | Initialization of the audit logs | |
| 10.2.7 | Creation and deletion of system-level objects | |
| 10.3 | Record at least the following audit trail entries for all system components for each event: | refer to PCI audit Log settings |
| 10.3.1 | User identification | |
| 10.3.2 | Type of event | |
| 10.3.3 | Date and time | |
| 10.3.4 | Success or failure indication | |
| 10.3.5 | Origination of event | |
| 10.3.6 | Identity or name of affected data, system component, or resource | |
| 10.4 | Synchronize all critical system clocks and times. | |
| 10.5 | Secure audit trails so they cannot be altered | |
| 10.5.1 | Limit viewing of audit trails to those with a job-related need | |
| 10.5.2 | Protect audit trail files from unauthorized modifications. | |
| 10.5.3 | Promptly back up audit trail files to a centralized log server or media that is difficult to alter. | |
| 10.5.4 | Write logs for external-facing technologies onto a log server on the internal LAN. | |
| 10.5.5 | Use file integrity monitoring or change detection software on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert). |
|
| 10.6 | Review logs for all system components at least daily. Log reviews must include those servers that perform security functions like intrusion detection system (IDS) and authentication, authorization, and accounting protocol (AAA) servers (for example, RADIUS). | |
| 10.7 | Retain audit trail history for at least one year, with a minimum of three months immediately available for analysis (for example, online, archived, or restorable from backup). |
Vulnerabilities are being discovered continually by malicious individuals and researchers, and being introduced by new software. System components, processes, and custom software should be tested frequently to ensure security is maintained over time. Testing of security controls is especially important for any environmental changes such as deploying new software or changing system configurations.
| Section | PCI Requirement | Comments |
| 11.1 | Test for the presence of wireless access points by using a wireless analyzer at least quarterly, or deploying a wireless IDS/IPS to identify all wireless devices in use. |
|
| 11.2 | Run internal and external network vulnerability scans at least quarterly and after any significant change in the network. ASVs are not required to perform internal scans. | |
| 11.3 | Perform external and internal penetration testing at least once a year and after any significant infrastructure or application upgrade or modification (such as an operating system upgrade, a sub-network added to the environment, or a Web server added to the environment). These penetration tests must include the following: | |
| 11.3.1 | Network-layer penetration tests | |
| 11.3.2 | Application-layer penetration tests | |
| 11.4 | Use intrusion detection systems, and/or intrusion prevention systems to monitor all traffic in the cardholder data environment and alert personnel to suspected compromises. Keep all intrusion detection and prevention engines up to date. | |
| 11.5 | Deploy file integrity monitoring software to alert personnel to unauthorized modification of critical system files, configuration files or content files; and configure the software to perform critical file comparisons at least weekly. |
As part of Theatre Manager's PA-DSS implementation process, creating a policy guide will be brought to the attention of venues desiring to be PCI compliant
| Section | PCI Requirement | Comments |
| 12.1 | Test for the presence of wireless access points by using a wireless analyzer at Establish, publish, maintain, and disseminate a security policy that accomplishes the following: |
|
| 12.1.1 | Addresses all PCI DSS requirements | |
| 12.1.2 | Includes an annual process that identifies threats, and vulnerabilities, and results in a formal risk assessment | |
| 12.1.3 | Includes a review at least once a year and updates when the environment changes | |
| 12.2 | Develop daily operational security procedures that are consistent with requirements in this specification (for example, user account maintenance procedures, and log review procedures). | |
| 12.3 | Develop usage policies for critical employee-facing technologies (for example, remote access technologies, wireless technologies, removable electronic media, laptops, personal data/digital assistants (PDAs), email usage and internet usage) to define proper use of these technologies for all employees and contractors. Ensure these usage policies require the following: | |
| 12.3.1 | Explicit management approval | |
| 12.3.2 | Authentication for use of the technology | |
| 12.3.3 | A list of all such devices and personnel with access | |
| 12.3.4 | Labeling of devices with owner, contact information, and purpose | |
| 12.3.5 | Acceptable uses of the technology | |
| 12.3.6 | Acceptable network locations for the technologies | |
| 12.3.7 | List of company-approved products | |
| 12.3.8 | Automatic disconnect of sessions for remote access technologies after a specific period of inactivity | |
| 12.3.9 | Activation of remote access technologies for vendors only when needed by vendors, with immediate deactivation after use | Team Viewer |
| 12.3.10 | When accessing cardholder data via remote access technologies, prohibit copy, move, and storage of cardholder data onto local hard drives and removable electronic media. | |
| 12.4 | Ensure that the security policy and procedures clearly define information security responsibilities for all employees and contractors. | |
| 12.5 | Assign to an individual or team the following information security management responsibilities: | |
| 12.5.1 | Establish, document, and distribute security policies and procedures. | |
| 12.5.2 | Monitor and analyze security alerts and information, and distribute to appropriate personnel. |
|
| 12.5.3 | Establish, document, and distribute security incident response and escalation procedures to ensure timely and effective handling of all situations. | |
| 12.5.4 | Administer user accounts, including additions, deletions, and modifications | |
| 12.5.5 | Monitor and control all access to data. | |
| 12.6 | Implement a formal security awareness program to make all employees aware of the importance of cardholder data security. | |
| 12.6.1 | Educate employees upon hire and at least annually. | |
| 12.6.2 | Require employees to acknowledge at least annually that they have read and understood the company's security policy and procedures. | |
| 12.7 | Screen potential employees (see definition of employees above) prior to hire to minimize the risk of attacks from internal sources. | |
| 12.8 | If cardholder data is shared with service providers, maintain and implement policies and procedures to manage service providers, to include the following: | |
| 12.8.1 | Maintain a list of service providers. | |
| 12.8.2 | Maintain a written agreement that includes an acknowledgement that the service providers are responsible for the security of cardholder data the service providers possess. | |
| 12.8.3 | Ensure there is an established process for engaging service providers including proper due diligence prior to engagement. | |
| 12.8.4 | Maintain a program to monitor service providers' PCI DSS compliance status. | |
| 12.9 | Implement an incident response plan. Be prepared to respond immediately to a system breach. | |
| 12.9.1 | Create the incident response plan to be implemented in the event of system breach. Ensure the plan addresses the following, at a minimum:
|
|
| 12.9.2 | Test the plan at least annually. | |
| 12.9.3 | Designate specific personnel to be available on a 24/7 basis to respond to alerts. | |
| 12.9.4 | Provide appropriate training to staff with security breach response responsibilities. | |
| 12.9.5 | Include alerts from intrusion detection, intrusion prevention, and file integrity monitoring systems. | |
| 12.9.6 | Develop process to modify and evolve the incident response plan according to lessons learned and to incorporate industry developments. |
Location:
/WebPagesEN/tmScripts
buttonRollover.html
Description:
<SCRIPT LANGUAGE="JavaScript">
<!--
function pviiClassNew(obj, new_style) {
obj.className = new_style;
}
//-->
</SCRIPT>
Since the buttons that are contained within the tmnavButtons.html page are form inputs, they require Cascading Style Sheets in order to customize their colours and styles. This script allows the buttons to roll from one style to another.
The variables onMouseOver="pviiClassNew(this,'buttonover')" onMouseOut="pviiClassNew(this,'button')" are included in each tag for each button.
dropDownMenuFuctions.html
Description:
<script language="Javascript">
<!--
function submitForm(form, action){
//Change the name of the hidden input, hiddenSubmit, to be the name of the action we need to perform
document.getElementById(form).hiddenSubmit.name = action;
document.getElementById(form).submit();
}
//-->
</script>
This function is used to submit a form when a <!select /> list is used. The page must include this function as well as a hidden parameter within the form, TMForm. <!input type=hidden name=hiddenSubmit value="">
navSideRollover.html
Description:
<SCRIPT language="JavaScript">
<!--
function NavRollOver(oTd) {if (!oTd.contains(event.fromElement)) {oTd.bgColor="";}}
function NavRollOut(oTd) {if (!oTd.contains(event.toElement)) {oTd.bgColor="";}}
//-->
</SCRIPT>
This script allows the cells within the navSide table to roll from one colour to another, creating dynamic buttons out of table data. The variables onmouseover="NavRollOver(this)" onmouseout="NavRollOut(this)" are contained within the
pleaseWaitMessageFuction.html
Description:
<script language="JavaScript">
<!--
function process() {
var processingMessage = 'Processing...please wait...this takes a few moments';
var messageHeight = '25px';
if (navigator.appName=="Microsoft Internet Explorer") {
pleaseWait.innerHTML = processingMessage;
document.all.pleaseWait.style.height = messageHeight;
document.all.pleaseWait.style.visibility = 'visible';
}
if (navigator.appName=="Netscape") {
document.getElementById("pleaseWait").innerHTML = processingMessage;
document.getElementById("pleaseWait").style.height = messageHeight;
document.getElementById("pleaseWait").style.visibility = 'visible';
}
if (navigator.appName=="Safari") {
document.getElementById("pleaseWait").innerHTML = processingMessage;
document.getElementById("pleaseWait").style.height = messageHeight;
document.getElementById("pleaseWait").style.visibility = 'visible';
}
}
//-->
</script>
showhidediv.html
Description:
<script language="javascript">
<!--
function divdisplay(layer_ref,state) {
if (document.all) { //IS IE 4 or 5 (or 6 beta)
eval( "document.all." + layer_ref + ".style.display = " + state);
}
if (document.layers) { //IS NETSCAPE 4 or below
document.layers[layer_ref].display = state;
}
if (document.getElementById &&!document.all) {
hza = document.getElementById(layer_ref);
hza.style.display = state;
}
}
//-->
</script>
This will show or hide a div statement by name on the screen state= 'none' if you want to see it on the screen state= 'block' if you want it to be disabled from the user.
<script language="javascript">
<!--
function divvisibility(layer_ref,state) {
if (document.all) { //IS IE 4 or 5 (or 6 beta)
eval( "document.all." + layer_ref + ".style.visibility = " + state);
}
if (document.layers) { //IS NETSCAPE 4 or below
document.layers[layer_ref].visibility = state;
}
if (document.getElementById &&!document.all) {
hza = document.getElementById(layer_ref);
hza.style.visibility = state;
}
}
</script>
this will change the visibility of a div by name on the screen state= 'visible' if you want to see it on the screen state= 'hidden' if you want it to be hidden off the screen from the user
There are two groups of buttons:
The menu Navigation buttons reside within the TMtemplates/tmnavButtons.html file, and are dynamically imported into each page via the <include> command. The command looks like:
<!--#include virtual="TMtemplates/tmnavButtons.html" -->
and creates buttons that look like:
Since buttons are subject to style changes, we are able to use Cascading Style Sheets to make them fit whatever concept your site incorporates, such as
These buttons are assigned classes (default to the button and buttonover classes) from the styleButtons.css style sheet, and can use javascript to create a rollover effect.
Data Input Buttons
The other buttons in each page serve different purposes by sending data to the database. These buttons work exactly the same way as the menu buttons only they allow Theatre Manager to receive the data that has been entered into the page and then load a new page page based on that data. An example of this would be to click on the Buy Tickets button
in the TMtickets.html page, which would send a command to Theatre Manager and open a new page based on the show that you clicked it for, allowing you to select seats for that performance.
The Data Input Buttons default to the 'new' and 'newover' classes in styleButtons.css.
Buttons Commands
This is a list of the button commands that Theatre Manager requires. They are entered as the name="xxx" portion of each input tag.
These commands cannot be altered.