Bug report: application process runs even if the user is not authenticated.

Hi all

I just stumbled on something that looks like a bug or a security problem for me:
When you have an application at a point 'Load - before the header (header of page template)' this process is executed no matter if a user is logged on or past validates a session ID in the URL.


Example:
In my Application, I have an application process to download a file when a certain application is defined. I chose the application process to hide the url/location of the user files and make sure that this file can only be downloaded in an application context (thank you Dene for inspiration: [http://apex.oracle.com/pls/otn/f?p=31517:15]). This works really well and did all the things I want to do.
But then I tried to call my download URL (for example http://myhost:myport / mytest/pls/f? p = 1234:0:123123123123:DOWNLOAD_FILE:NO ::) from another computer without logging in.) I expected to get the login screen of my application and all my pages require authentication, but I got the file.

To work around this problem, I put in condition of the pl/sql process ": APP_USER IS NOT NULL AND: ASK 'DOWNLOAD_FILE' = ', now it works as expected and shows the login page if the user is not authenticated or given to the session id is null/not valid."


I am mistaken and that the process should not run? I put same authorization "must not be public user" who has been ignored as well.

Peter

Peter and Dene,

Thank you for this comment. I agree that this is a bug and we'll fix it. A solution you can set the attribute Public user of your application to PUBLIC_USER. As long as your FATHER connects as apex_public_user it shouldn't break anything.

Scott

Tags: Database

Similar Questions

  • Select the application element when the user is not authenticated.

    Hi, quick explanation just what I would do:

    I would like to allow the user to connect to the system and open the page that he or she has been redirected in edit mode.

    My application sends e-mail notifications to users. When user click on the link of the page opens (application allows anonymous access in the playback mode).

    The problem is that when users try to connect to the application, they are redirected to the home page.

    My intention is to create button Edit on the page. This button will be variable application with the "page url" value and redirect users to the login page.

    After login, the login process looks like this:

    (wwv_flow_custom_auth_std). Login
    P_UNAME = >: P101_USERNAME,.
    P_PASSWORD = >: P101_PASSWORD,.
    P_SESSION_ID = > v ('APP_SESSION').
    P_FLOW_PAGE = >: APP_ID | : F101_INITIAL_PAGE_NO

    );

    Where: F101_INITIAL_PAGE_NO is my point of application.

    I also created processes to define: F101_INITIAL_PAGE_NO if its value is null, so there is always the page to be redirected to.

    The problem I have is that I can not put point of application to the value I want to when I'm not authenticated. When I am authenticated everything works fine (I can request value set).

    The way I put the value of the element is:

    function setItemValue (item, value)
    {
    Alert (Item);
    Alert (value);
    get var = new htmldb_Get (null, & APP_ID., 'APPLICAITON_PROCESS = dummy', 0);
    Get.Add (Item, value)
    gReturn = get.get ();
    get = null;

    }

    My point of application is also unrestricted.

    All of the suggestions.

    Thanks in advance.

    get var = new htmldb_Get(null,&APP_ID.,'APPLICAITON_PROCESS=dummy',0);

    call page 0. This page is in your case probably fixed to "authentication: Page requires authentication. This is why it does not work.

    Denes Kubicek
    -------------------------------------------------------------------
    http://deneskubicek.blogspot.com/
    http://www.Opal-consulting.de/training
    http://Apex.Oracle.com/pls/OTN/f?p=31517:1
    -------------------------------------------------------------------

  • How to prevent the login page in the same browser when the user is already authenticated

    Hello

    I use Jdev 11.1.1.6 with ADF implemented in my application security.

    I have Login.jspx that redirects the user to Home.jspx on a successful authentication. The user can either enter the URL of the Home Page or Login.

    Please consider the following scenarios:

    (a) the user is not authenticated in the current browser session

    (a.1) if the user enters the URL of the home page and the login page is displayed and redirected to the homepage on authentication

    (a.2) if the user enters the login page URL, then the login page is displayed and redirected to the homepage on authentication

    (b) the user is already authenticated in the current browser session, a new tab opens and

    (b.1) if the user enters the URL of the homepage then it shows directly the (already authenticated) Homepage

    (b.2) if the user enters Login URL then connect a page appears - This is the issue, it should either user to the homepage or invalidate the existing session and let users to proceed again.

    How do I get there? Any help is appreciated.

    Thank you

    JAI

    Hello

    the authentication check must be in a phase listener or servlet filter. If you use a phase listener and the homepage and login have a link associated with the ADF (PageDef file) then in the phase AFTER RESTORE_VIEW, you can use AdfContext.getCurrent () .getSecurityContext () .isAuthenticated () to tell if a user is authenticated or not.

    Frank

  • Firefox continues to run even after the release in Manager Windows tasks and has about as much memory to affect other applications

    Firefox continues to run even after the release in Manager Windows tasks and has about as much memory to affect other applications. Firefox.exe must be completed manually in Windows Task Manager. Is there a software patch that will force the release of memory and all the resources of the computer that was using Firefox, when it is finished?

    This has happened

    A few times a week

    == I see only the program in the Manager of tasks over the past months but the problem could took place for more

    See this:
    https://support.Mozilla.com/en-us/KB/Firefox+hangs#Hang_at_exit

  • How we force a query to use transparently a hint, even if the index is not given in the query as a query rewriting.

    How we force a query to use transparently a hint, even if the index is not given in the query as a query rewriting.

    For example:

    If the user runs a query select deptno, avg (sal) from emp group by deptno;

    We want the optimizer to use a hint of result_cache with this request, and it should be transparent to the user.

    Query should be rewritten to seamlessly

    Select / * + result_cache * / deptno, avg (sal)

    WCP

    Group of deptno;

    How can this feature we make? Please advice.

    I checked the possibility of SPM and contours, but it is not clear if this rewrite is possible here.

    Thank you and best regards,

    Vikas Krishna

    Surely dbms_advanced_rewrite is designed for this situation?

  • I'm trying to refresh for CS6 bridge and the dialog box always tells me to close the bridge first even if the bridge is not open

    I'm trying to refresh for CS6 bridge and the dialog box always tells me to close the bridge first even if the bridge is not open

    Bridge is probably running in the background.

    Error "Setup cannot continue until...". Adobe Bridge is closed. Installation | CS5

  • EventHandler process post for all the user records in the system target

    Hi Experts,

    My environment: IOM - 11.1.1.5, Sun Directory Server - 5.2
    I did after,

    1. implement the recon trust with Sun's LDAP
    2. I was able to read the sun ldap users to the IOM
    3. I wrote the post event handler process for updating the user password. It works fine if the connector gets only a new user
    4. size of the batch = 0, in iPlanet Planner recon trusted user.

    My Question:

    In my target system, I have 100 users, for recon trust I need calling the game/Manager events vertical process of post for all 100 records and update process. Now, it runs only for the last record not for all records.

    My event handler is,

    <? XML version = "1.0" encoding = "UTF - 8"? >
    < eventhandlers xmlns = "http://www.oracle.com/schema/oim/platform/kernel" xmlns: xsi = "http://www.w3.org/2001/XMLSchema-instance" xsi: schemaLocation = "http://www.oracle.com/schema/oim/platform/kernel orchestration - handlers.xsd" >
    <! - custom event handlers process post - >
    < class = "Manager com.custom.eventhandlers.CustomPostProcessEventHandler of shares" kind of entity = "User" operation = "CREATE" name = "CustomPostProcessEventHandler" order = "8000" stage = 'postprocess' sync = "TRUE" / > "
    < / eventhandlers >

    I do with sync = TRUE-> FALSE?

    Please give your suggestions.

    Thank you

    The event handler will trigger in the BulkExecute. In this code, you must loop through all entries and not just the last.

    You do this in your code?

    -Kevin

  • Our published application crashes when the user is not connected to WiFi

    It became clear after the last launch edition our published application crashes when the user is not connected to WiFi.

    This is a new one on us, someone at - it ideas?

    There was a bug in all versions of Viewer 24 and earlier that have arisen during the last iOS updated acme outside. If you upgrade to v25 or later version the issue will go away.

    Neil

  • How can I make sure my internet cable works even if the icon is not displayed by the clock

    I see the wireless connection icon, but I used to see one for the wired connection also. So where is it?

    How can I make sure my internet cable works even if the icon is not displayed by the clock?

    Click Start > Control Panel > network and Internet > network connections.

    Click with the right button on your Local network, and select Properties. In the window properties of LAN make you that these boxes are checked.

    [] Display the icon in the Notification area when connected

    [] Notify me when this connection is limited or no connectivity.

    Click [OK] and get out of here!

    Right-click on start and select Properties. On the taskbar and Start Menu click the taskbar tab, and then click the Customize in front of the Hide icon button inactive and it make sure that the option 'always show' for the local network is selected.

    HTH,

    NASS - http://www.nasstec.co.uk

  • Unable to connect even after the user password reset

    Hai all,

    10.2.0.3 on Linux

    Reset a user password and the user is unable to connect as you can see below


    [oracle@testdb 10.2.0] $ sqlplus sys/Manager as sysdba

    SQL * more: release 10.2.0.3.0 - Production on Tue Nov 27 16:20:21 2012

    Copyright (c) 1982, 2006, Oracle. All rights reserved.


    Connected to:
    Oracle Database 10 g Enterprise Edition release 10.2.0.3.0 - Production
    With partitioning, OLAP and Data Mining options

    SQL > alter user sysman identified by oracle.

    Modified user.

    SQL > disconnected from Oracle Database 10 g Enterprise Edition release 10.2.0.3.0 - Production
    With partitioning, OLAP and Data Mining options

    [oracle@testdb 10.2.0] $ sqlplus sysman/oracle

    SQL * more: release 10.2.0.3.0 - Production on Tue Nov 27 16:20:32 2012

    Copyright (c) 1982, 2006, Oracle. All rights reserved.

    ERROR:
    ORA-01017: name of user and password invalid. connection refused



    Unable to connect even after the user password reset

    Check
    How to change the password of the database user Sysman (DB control repository schema) [ID 259379.1]
    EMCA 11 g fails with the error "ORA-01017: name of user and password invalid; connection refused"and" username/password invalid name; For DBSNMP or user SYSMAN"[ID 741530.1]

  • Won't COMPLETE event triggers of level FEIELD, even if the user clicks ABOUT on the field in question?

    Hello

    Pls can someone answer my question pls its here is the link

    http://forums.Adobe.com/message/4549663

    Q just quick who:

    Won't COMPLETE event triggers of level FEIELD, even if the user clicks ABOUT on the field in question?

    Thank you

    Hello

    Here is an explanation of the output events of the specification XFA (page 391).

    get in, get out

    Enter the event fires when the field gets keyboard focus, that it was caused by a user action

    (in the field of the tab or by clicking with the mouse) or by a script by setting programmatically the

    Update. It is also raised when a new selection is made from a list of choices, but this behavior can be prevented.

    See below.

    The exit event is triggered when the field loses keyboard focus. It has also triggered whenever there is a new selection

    in a list of choices (followed by an input event), but this behavior can be inhitibited.

    I hope this helps.

  • How to make a text field required at run time when the user clicks on the box?

    I had a form, there are several checkboxes fields and the text associated with the check boxes. If the use clicks on the checkbox then partner

    text fields should become mandatory. I tried the change event and the click event of the boxes. There is error in the onChnage event and I got some odd results in the click event on. Sometimes, if the user clicks the check box, then for the 1st time the field is not required, then the user onclicks the box and when the user clicks the check box for the second time the field becomes necessary, but if I turns off the option highlight the field and selects the field becomes necessary even if the user onchecks I am totally confused! To add that I have also written an incorrect code always I reached the goal? How it can be possible. I write the codes below, please help me because I am working under a deadline from the client.

    onChange event:

    var = this.boundItem (xfa.event.newText) newVal;
    if(newVal == 0)
    {
    xfa.resolveNode ("form1. Subform0.Subform1.Subform9.Subform10.Table48.Row4.Purchasecost3_1'). validate.nullTest = "disabled";
    }
    on the other
    {
    xfa.resolveNode ("form1. Subform0.Subform1.Subform9.Subform10.Table48.Row4.Purchasecost3_1'). validate.nullTest = 'error ';
    }*/

    For the onClick event:

    var a = xfa.resolveNode ("form1..") RawValue Subform0.Subform1.Subform9.Subform10.Table48.row2.CostItemRecovere d_OnlyEnergyCharges");
    App.Alert (a);
    if(a == 0)
    {
    xfa.resolveNode("form1.Subform0.Subform1.Subform9.Subform10.Table48.Row4.ComplianceCheck__L1_1").validate.nullTest = 'error ';
    }
    if(a == 1)
    {
    xfa.resolveNode("form1.Subform0.Subform1.Subform9.Subform10.Table48.Row4.ComplianceCheck__L1_1").validate.nullTest = "disabled";
    }

    Please help someone!

    Hello

    You may need this resolved at this point, but here are a few tips.

    An example of a loop in a dynamic array is here: Re: how to make invisible/visible or hidden columns with checkbox?

    You are usually not necessary to resolve the nodes, especially when the script object is in the same table as the target objects.

    For example if the table was not static your script could be simplified:

    if (this.rawValue == "1")  // this object is in Row2
    {
         Row4.ComplianceCheck_L1_1.mandatory= "error";
    ...
    }
    

    However because you will be to loop through all the rows in the table repeatable instances / then you need to resolve the nodes. Take a look at the example above.

    In your script, you have to Row8 Row4. I don't know if this is repeatable or just some of them. If we take Row4 as being repetitive, then you can apply the following to all repeatable lines.

    var vRow4 = Table48._Row4.count;
    console.println("Row4: " + vRow4); // You can delete this or comment it out after testing
    
    if (this.rawValue == "1")  // this object is in Row2
    {
         for (var i=0; i
    

    I have not tested, but it should be close to work.

    Good luck

    Niall

  • Pdf forms can always send the xml data (even if the pdf does not extend)?

    Hello

    My problem is the following. I have Acrobat Professional license, so I can create pdf forms.

    I added a shipment through the mail button to my form and sent to the end user, who had only the acrobat reader software. He was able to complete the form and send its data via the e-mail button, and I got an xml with the data file.

    Because I had not extended the document, I suppose it's always possible, so I can always receive the xml data in completed forms, I can't?

    Then also extended the professional Acrobat document (Tools-> enable usage rights in Adobe Reader), because I need the final customer, be able to save the form. Now, I just sent this document extended by mail (do not use the tool Distribuite form in Acrobat), the user has clicked the button and again once I received my xml.

    Now, I want to back my document to a maximum of 500 customers, I have no limitation?

    I quote acrobat licenze agreement:

    14.13.3 for any unique Document extended, you may only either (a) deploy this Document extended to an unlimited number of recipients unique but shall not extract information from more than five hundred 500 unique of this extensive Document instances or any representation of a paper copy of this Document extended with fields of form [...]

    Since the function I described before (the xml data emailing) is granted even if the document is not extended, I think that this limitation does not apply to me. Am I wrong?

    The limitation applies instead if I use the function 'Distribuite form' (forms-> Distribuite forms...) in acrobat professional. If I use this feature for distribuite the form, an email is automatically sent by acrobat (and not manually by me, as before) and pdf dataset is created. When the end customer cliks button, a pdf file (and not an xml) with the data are sent to me. If I double click on acrobat fills the dataset that was created with the data. It is the extraction of information to which the license relates?

    This is my conclusion: a pdf form can still send data xml by the player, and if I Express with acrobat, the end-user can also record. The only restriction is to distribute the form using "Distribuite form", but if I use it not I have no limitation on the number of times where ever I can get xml data.

    Can anyone confirm that my conclusion is just?

    Thank you very much

    Giuseppe Romeo

    You can try the link "contact us".

  • "The session is not authenticated." all in createContainerView

    Hello

    I use gSOAP (http://www.cs.fsu.edu/~engelen/soap.html) to create stubs of the vim.wsdl file provided by vmware sdk C++. Using these heels, I wrote a simple client application that starts with extract service content (using the retrieveServiceContent method) and then connects to the vcenter Server (using the connection method that takes the ManagedObjectReference of sessionManager returned by retrieveServiceContent(), username and password).

    But after that when I call the createContainerView method to create a view of the VirtualMachines, it returns the SOAP_FAULT:

    SOAP 1.1 fault: "': ServerFaultCode [no sub]
    "The session is not authenticated.

    What is the way to authenticate a session? Kindly guide me on this.

    I spent a lot of time on this a few years ago, but I didn't spend much time on this topic recently... I've maybe rusty.  If I recall, however, the session not authenticated (assuming that your configuration is correct) is usually a failure to include the WITH_COOKIES macro in the build process.

    Keep in mind, all compilation gSOAP products as well as your executable program must include WITH_COOKIES.

    You will need - DWITH_OPENSSL-DWITH_COOKIES.  I used to include - DWITH_GZIP, but I have never tested the GZIP support (should be automatic for compression).

    I ended up creating Makefiles to generate static and dynamic libraries especially with long compile times that you get with the huge vSphere SDK WSDL.

  • Satellite Pro M30 - error message: the user is not authorized to update BIOS

    Hello

    I bought a Satellite Pro M30 of second hand. This one has the Bios 1.30... I would like to install the bios v1.70.

    I am running Windows XP Pro SP3 and tried first update in Windows.
    I however got the message "the user is not allowed to update BIOS.

    This message is quite surprising given that I have administrator privileges.

    I read that you can use a floppy disk to update, but I did not...

    So, is it possible to update the Bios with the CD?

    See you soon,.
    R.S.

    Hello

    I checked the page European driver of Toshiba and found the version of BIOS 1.7 WIN in the field of ARCHIVES.

    As you can see, it's a version of BIOS Windows and not a traditional version of the BIOS (trad BIOS can be updated using the diskette).
    This BIOS win can be improved only from a running OS Win.

    In any case, I see that you have installed SP3. It could have a bad influence on the update of the BIOS.
    Then maybe you should try to update the BIOS without SP3 installed?

    Remove SP3, download the good BIOS, unzip correctly and then try to run the BIOS update file.

    _Ps: If you laptop then runs without problem a BIOS update is not necessary! _

    Concerning

Maybe you are looking for