Violation of protection of State session. Apex 5.0

Similar Questions

• Statement of apex management 4.2: intellectual property protection

  4.2 review and don't see not where the below stated guidance is addressed. While I found the ability to package an application with install sql scripts and others. I can't find where there was the possibility of protecting intellectual property rights. I missed something or has simply not addressed or included? IE: there should be the possibility to export and install an application read/only run with or without the ability to circumvent or modify administrator.
  
  http://www.Oracle.com/technetwork/developer-tools/Apex/application-express/Apex-sod-087560.html
  
  Oracle Application Express
  Management representation statement
  Last updated: April 18, 2012
  ..
  Application deployment - provide more opportunities for the packaging and distribution of APEX applications to improve the protection of intellectual property rights and to facilitate customization.
  ..

  Hi Johnny,.

  Due to time constraints, we do not unfortunately have to address the function of Application deployment, as indicated in the declaration of the Direction you provided a link to APEX 4.2. However, it is our intention to address this feature in a future version of Application Express.

  Kind regards
  Hilary

• Popup of State session

  APEX 4.2
  
  By clicking on the link of Session at the bottom of a page run through the constructor a page that displays elements session state data.
  
  But when page elements are populated by an automatic APEX fetch line treat such as Type of Source / = Always/database column, these page elements do not appear on the window session state, so that we cannot see their values.
  
  I'm sure it wasn't the behavior of 4.0. No idea why it was changed? Is there a way to return to the original behavior?
  
  Thank you

  Hi Vikas,

  This is due to changes in 4.2 to session state management. It improves performance and reduces the roll forward.

  Kind regards
  Christian

• How to keep the State page apex value after connection page

  Does anyone know to keep the State in a page of the apex, when I go to another page and come back? He keeps all the values entered into the fields, it seems that the gaps?
  
  I have 5 regions and each region have elements: text fields, selectors of dates, popup lov, field numbers, text box and view point only. When I go to the next page with redirect and return I see popup lovs values and values of one or two display items only. The values of the other text fields, dates selectors and the display just empty.
  
  Thank you everyone can help. Thank you.
  
  Kind regards
  Dragan

  Hello

  This element only display recording session state?
  Checks the attributes of the element.

  Kind regards
  Jari

  -----
  My Blog: http://dbswh.webhop.net/dbswh/f?p=BLOG:HOME:0
  Twitter: http://www.twitter.com/jariolai

• ID of Session apex and the Google URL parameters

  I think my question is maybe too obscure to get an answer... but I hope...

  I maintain a site that has links to resources for Oracle Certification tests (documentation, articles, videos, books, etc.):

  http://www.oraclecertificationprep.com/Apex/f?p=OCPSG:main

  The site is (obviously) use Application Express as a backend.  My problem is that even if I have the keys pages/tabs/configured to use the Session ID 0, somehow, not nonzero is creeping in session ID.  I really wouldn't worry except that Google ends up getting URL with zero session id indexed for the Googlebot to go.  The result is that Google gets errors of analysis which he maintains have reported to me.  I have delete - more pop up. I delete those, repetition...

  There is a feature in the page of Google Webmaster tools to set up "Parameters of URL" make Google to know what parts of a URL are temporary and should not be treated as a separate URL entry.  However, there are warnings if you configure the incorrect URL parameters, you will end up by excluding indexing course pages at all.

  So my question is (finally) if someone used Google Webmaster tools to set up the ID of session as parameters, and if so, how they went to do.

  Hello

  I'm not sure that you can configure ignore the id of session on tools for webmasters.

  Try to add the canonical link to your pages with zero session id.

  Official Google Webmaster Central blog: specify your canonical

  Or create application processes always redirect to zero session if the url session id is something else.

  Kind regards

  Jari

• Disconnect all sessions APEX to upgrade an application

  HelloW,

  OK, it is well known that when you upgrade an application (replace with a new version) you must first log out of the application.

  If you do not do this, the application in your current session will become very unstable.

  I do not have the rights DBA. I'm a developer of simple applications

  I have a go of the business to upgrade a certain application in production with a new version that is firmly put to the test.

  What I want, is that a simple procedure to disconnect all currently connected users so I can move the application without having to worry about volatile sessions.

  IMHO, this should be possible in the worksheet sql out of my work space where only application developers have access to.

  Is there a way to do it or what I really have to ask the DBA is to kill all sessions manually? Believe me, they don't like it

  Concerning

  Nico

  Nico Martens wrote:

  Hi and thanks for the replays. I am currently not at my desk, but the solution of jariola require the activity of users...

  What happens when the user has application to open in a page, but does not work. Can I transfer my application and the user begins to work again?

  Jari works if you deploy the application by using different application ID but the same alias applicationand don't give the URL containing the alias for users. The application in the dormant session is not available when the user then attempts to access it, and they start a new session using the alias of the app, which will now point to the version of the application with the new code.

  If always reuse the same ID you can also use the approach detailed in Re: user "Kick" to the application after the password has been changed. but compare version of the application rather than hash password. As you don't want no interaction with the new version of the app, change the point of treatment for on submit - before the calculations and Validations.

• disables the State protection of pages without argument running session

  Hi all
  
  
  
  Components shared = > Security = > authentication schemes = > Application Express - current
  
  I did the steps of folowwing:
  
  Components shared = > Security = > Protection of the State of Session = > button Set Protection
  in the screen folowwing press Enable followed by next
  in the next screen, tap the Protections of State Session enable
  
  
  
  in the page components shared > Session State Protection > Protection of the Session State by Page
  
  the two page 0 and 1 are unrestricted
  
  STIL, I can't start my application
  
  page error 1:
  No checksum has been provided to show the processing of a page that requires a checksum when one or
  
  ask more, clear the cache, or argument values are passed as parameters.
  
  
  page 0 and 1 have no element
  
  Page 1 has a region of the type list
  and uses the list available on page 0, but using a list template override od Pull Down Menu with
  
  Image of the same list on page 0 has a model list of Menu DHTML with sublist
  
  
  
  I am at a loss of the EUL solutions is the protection of the session off all State
  
  
  
  
  
  Help, please
  
  KR
  Martin

  It's a quirk in how the login page is called using the deep link, created by the manufacturer. To work around this problem, you can set page 101 to Unrestricted so that no amount of control is necessary.

  Scott

• Session state protection violation

  I created the sample application to the free workspace

  https://Apex.Oracle.com/pls/Apex/f?p=4550:8:0

  Name of workspace: WMS_USER

  Username: [email protected]

  Password: password! 23

  Request 40363 - shipping Office
  : - > Run: click the report item

  When I select the number of the item 50004257 and click on the button new 1 then show the error like session
  violation of protection State

  Can you please help

  This link is not a job for me.

  2942415 wrote:

  I created the sample application to the free workspace

  https://Apex.Oracle.com/pls/Apex/f?p=4550:8:0

  Name of the workspace: WMS_USER

  Username: [email protected]

  Password: password! 23

  Request 40363 - shipping Office
  :-> Run it: click the report item

  When I select item number 50004257 and click on the button new 1 then show the error like session
  violation of protection State

  Can you please help

  This link is not a job for me.

  Check your work application.

  p3_item_desc--> edit-->--> No. session state

• Session state protection error

  Hello

  I get an error on the browser Internet Explorer (doesn't happen in chrome), which States "Session State protection violation: this can be caused by manually editing the protected page P11_NEW_FLAG point." If you don't know what caused this error, contact the administrator of the application for assistance. Contact your administrator for the application. "

  
  

  I don't know why this error because the element P11_NEW_FLAG is NOT protected at all. Here's the security properties are attributed to him:

  
  

  
  

  

  It has a readonly condition associated with him making it readonly based on some logic PL SQL.

  I don't know where to start debugging? What can be the root cause?

  Thank you

  Sunil Bhatia

  Hi Sunil Bhatia,

  Sunil Bhatia wrote:

  Hi mohamed,.

  No, its not hidden item, it's a FLAG (Checkbox) I display on the front end. There are readonly. I debugged and error occurring only when the box is read-only. It automatically creates checksum argument.

  Other settings to watch?

  Thank you

  Sunil Bhatia

  You use the condition parameters of article readonly?

  CheckBox and select items does not in HTML readonly property. ReadOnly checkbox in the case of Oracle APEX is setting the disabled property. Therefore, on presentation of the page it is originally the error of session state protection.

  An easy way to do this is to write a dynamic action (run Javascript) to disable the checkbox if necessary:

  $("#P11_NEW_FLAG").attr("disabled",true);
  

  But write a front page submit dynamic action (run Javascript) to activate elements disabled on the page, so that the layout of the page works fine:

  $("#P11_NEW_FLAG").removeAttr("disabled");
  

  Reference: Apex tips and tricks - an easy way to make read-only items

  I hope this helps!

  Kind regards

  Kiran

• Protection of session state - Arguments must have Checksum - help needed

  Hello world
  
  I use apex 4.0 and that you have defined:
  
  Protection of session state = True
  Page = Arguments access protection must have the checksum
  Point of application protection = Cecksum required - Session level
  Page data entry point Protection = required Cecksum - Session level
  Page Display-Only item = Cecksum required - Session-level Protection
  
  On the pages that contain an interactive report, calls to other pages updated and or to delete a record from the pharmacokinetics of recording work OK.
  I put these as follows:
  In the Interactive report link-> Link attribute column = onclick = "new top. Ext.apex.PopupWindow ({url: this.href, title: 'Change collation details', width: 530, height: 500, listeners: {'success': gReport.search}}). show(); return false; »
  Target = this Application Page
  Page = 302Item = P302_IDCLASS
  Value = #IDCLASS #.
  Page Checksum = - default user.
  
  The problem is the button 'Create a new record' that is on the page of interactive report. I set the button as:
  The attributes button = onclick = "new top. Ext.apex.PopupWindow({url:'f?p=&APP_ID.:302:&APP_SESSION.::NO:302:::',_title:_'Create_New_Classification',_width:_530,_height:_500,_listeners:_{'success':_gReport.search}}).show (); return false; »
  Action when click = redirect to the Page of this Application
  Page = 302
  Clear Cache = 302
  
  When I click the button I get the following message:
  Session state protection violation: this can be caused by a manual change to a URL containing a checksum or using a link with a missing or incorrect checksum. If you don't know what caused this error, contact the administrator of the application for assistance.
  
  If I change the attributes of the button to be:
  OnClick = "new top. Ext.apex.PopupWindow({url:'f?p=&APP_ID.:302:&APP_SESSION.::NO:::',_title:_'Create_New_Classification',_width:_530,_height:_500,_listeners:_{'success':_gReport.search}}).show (); return false; »
  
  It works OK, bu page elements are not clear.
  
  Could somebody please explaing to me what I am doing wrong so I understand my mistake?
  
  Thank you
  
  Daniel

  Hello

  If I understand correctly what you need...

  Create a point of the MY_BTN_URL application.
  You can set this element of Protection of the Session State to 'Restricted - cannot be resolved in the browser.
  Create the calculation of demand for this article
  Calculation Point: Before header
  Calculation type: PL/SQL Expression
  Calculation:

  APEX_UTIL.PREPARE_URL (
    p_url => 'f?p=&APP_ID.:302:&APP_SESSION.::NO:302::::',
    p_checksum_type => 3
  );
  

  Change your attributes of button

  onclick="new top.Ext.apex.PopupWindow({ url:'&MY_BTN_URL.', title: 'Create New Classification', width: 530, height: 500, listeners: {'success': gReport.search} }).show(); return false;"
  

  Kind regards
  Jari

  Published by: jarola October 25, 2011 15:50

  Published by: jarola October 25, 2011 16:16

• State of session and CSS

  If you have an element of the screen which must have the value 'Yes' session state, session state economy causes CSS not working for this element. Change 'save session state' on 'no', and the CSS will work.
  
  Is there anyway for the session state value "yes" and also have the CSS for the work item?

  Doug wrote:
  If you have an element of the screen which must have the value 'Yes' session state, session state economy causes CSS not working for this element. Change 'save session state' on 'no', and the CSS will work.

  Is there anyway for the session state value "yes" and also have the CSS for the work item?

  If the display settings do not save session state then APEX product just a scope where the id attribute is the name of the element, the ID CSS selector is simply the name of the element. If the elements save session state, then APEX generates an element entry hidden where the id attribute is the name of the element and a visible display shadow cover where the id attribute is the name of the element suffixed with DISPLAY, the required CSS ID selector would be so #ITEMNAME_DISPLAY.

  This is obvious if you inspect the element using the web Inspector.

• Sessions of the apex to the upcomig WORLD Kscope11 question

  Hope that this applies to ask here, but I see that there are a good number of sessions Apex at this WORLD conference and see a few familiar names I've learned a lot about the format of this list. No one knows if they ever sessions of the Conference such as these on a webcast? I tried to put a note on the WORLD site, but thought I would also ask here. Due to economy travel budgets are tight. It would give another option to learn some new exciting topics and how to apply the Apex, in tight budget times.
  
  Thank you
  Mark

  Hi Mark,

  WORLD is sometimes webinars, see http://www.odtug.com/apex/f?p=500:235:0:P235_NEWS_ID:3061 (14 June there is an APEX one by Dan McGhan). Not necessarily exactly the same as the Conference.
  Redgate offers free webinars now and then, for instance https://www2.gotomeeting.com/register/251093450 (APEX for Mobile).
  Skillbuilders (where Dan works) also offers free online seminars, see http://skillbuilders.com/

  But the best thing is to be in Long Beach, of course...

  Concerning
  Roel

• State of the coast customer Pass to the modal dialog box

  Hi guys,.

  I would like to open a modal dialog box and change the value of a select list of the modal dialog box. I have to be able to switch the status of the customer value using apex.item("P1_DEPTNO").getValue (). The declarative method to use modal dialog boxes is to use a button and a link to the page, where everything is taken care for us, the value, the checksum for the protection of session state, etc..

  But sometimes we need to go on the side of current customer State the modal page, for example, while we are in the middle of creating a new row in a table... and the value is not yet stored in the database.

  So, how can we do this? By the way the page in progress and also variables to generate the control are appropriate for the items to be passed.

  Since there is no dynamic action to do this directly, I tried to attach a dynamic action to a button and run javascript to open the dialog box (https://docs.oracle.com/cd/E59726_01/doc.50/e39149/javascript_api.htm#AEAPI29504):

  var l_url="f?p="+$v("pFlowId")+":2:"+$v("pInstance")+"::::P2_DEPTNO:"+apex.item("P1_DEPTNO").getValue();
  alert (l_url);
  
  
  apex.navigation.dialog(l_url, {
      title:'About',
      height:'480',
      width:'800',
      maxWidth:'1200',
      modal:true,
      resizable:false },
      '',
      $('#EMP_REPORT'));
    
  
  
  

  Unfortunately, I get an error internal an error:

  2 request 157 dialog page cannot be returned successfully. If make sure that the template in use on page 2 is the type of model 'Page of dialogue', with the JavaScript dialog initialization appropriate, closing the dialog and dialog box cancel the code defined.

  I do not understand the error message since I use the theme 42 and the handling of the ordinary modal dialog box works.

  Would appreciate advice.

  See you soon,.

  ~ Dietmar.

  Hi Dietmar,

  you're always coming to these requirements of fancy...

  The following has worked for me in Chrome. But to test if it works in any browser.

  1. Describe your button as usual with a link to the page of the dialog box
  2. For example to set items , specify P7_CUSTOMER_ID as the name and ~ CUSTOMER_ID ~ as value. ~ CUSTOMER_ID ~ is our placeholder that will NOT get replaced by APEX. We use it in our JavaScript code.
  3. Set the static ID of your my_button button so that we are able to access in JavaScript
  4. In the run when the Page loads page level attribute, add something like

     var myButton$ = $( "#my_button" );
     myButton$.attr( "onclick", myButton$.attr( "onclick" ).replace( "~CUSTOMER_ID~", "' + $v( 'P2_CUSTOMER_ID' ) + '" ));
     

  The JS code above will replace your reserved space and turn the link into something like

  javascript:apex.navigation.dialog('f?p=73380:7:109940056598048::NO:RP:P7_CUSTOMER_ID:' + $v( 'P2_CUSTOMER_ID' ) + '\u0026p_dialog_cs=QxixrjW-ZGmCMXTNBPlITtOG_X3aShXqYmmaugetfJ8rYKRHHpJpeskKbIEO3qpqVIkX-dWYaqbZ0_AGq3ASTg',{title:'Sample Database Application - Customer Details',height:'480',width:'660',maxWidth:'1000',modal:true,dialog:null},'t-Dialog--wizard',$('#my_button'));
  

  Obviously, you will not be able to use the Protection of the Session State for the P7_CUSTOMER_ID dialog page item, so you set the page of dialogue level attribute Access Protection Page to the Unrestricted.

  The amount of control that see you in the URL is really just to protect the dialog box itself.

  Concerning

  Patrick

• OHS & APEX - office/Mobile NO alternative standard connection to consume the apex and on request

  Hi all

  I have quite the problem and I do not see a solution and I hope someone might be able to provide advice how to on this subject.

  Here is my scenario:

  ===============

  I have 2 APEX applicationa, both with its own set of processes on demand (about 300), authentication schemes, page elements. Each application is only 2 pages (login, home).

  I've got 2 software applications, running on the Office of the AIR and the other a mobile application.

  Problem

  =====

  Connection for APEX WITHOUT ever going to the login page of the application in a web browser. In short, think of it as if I had BROWSER WEB No..

  I need to identify, authenticate and retrieve session information so I can call and then process on request through some Ajax calls in my applications, using post/get and pass the base APP_ID, PAGE_ID, SESSION_ID.

  Security must stay tight, which means that all calls are made via https/SSL.

  Currently, I can come out with a solution dirty air, which is to pass the user name, password the URL to the login page.

  Connection direct yo the database is not an option.

  Is where I'm stuck, how can I do this correctly.

  I recently worked around a violation of the page, passing the name of user and password in the URL, but the mobile app gets Bad request.

  I even started looking at REST, to provide the login? But how to replace this APEX for session state, session valid etc..

  But what would be the entire installation, that's what troubles me. ? Is there an api I do not know of. Whaty I am missing. I've worked with Oracle 8 years and cannot imagine not being able to connect to APEX without going to a web page.

  Maybe there is a way to expose some PL/SQL for the internet in a safe way? According toher, rewriting authentication custom apex coding style (htp.init, get_cookie, set cookie, apex_application_custom_auth, etc.)?

  Platform

  =======

  Oracle 11.2.0.4

  Apex 4.2.4

  OHS 11 g

  --> Possible APEX reverse listener with proxy?

  Thank you

  Jan S.

  Hi Jan,

  No worries :-) I'm used to this lack of hits, especially since we also have a Christina in the team of the APEX.

  Just issue the cookie 1:1 with htp.p line, as read you. After owa_util.mime_header is a good place to do that, Yes. Your code may look like the example below, but of course it must issue the cookie that he just read, not sample one of your previous post.

  owa_util.mime_header('text/html', FALSE );
  htp.p('Set-Cookie: ORA_WWV_APP_70070037001=ORA_WWV-Ic4nT76UhbDoIP5tGBweGWxW; HttpOnly');
  htp.p('Cache-Control: no-cache');
  htp.p('Pragma: no-cache');
  owa_util.http_header_close;
  

  Kind regards

  Christian

• Hidden point - 'Value protected': when its value is editable?

  Question: When a 'Protected value' hidden element is editable?
  
  I see http://docs.oracle.com/cd/E17556_01/doc/user.40/e15517/item_types.htm:
  
  Hidden element
  Attributes of parameters:
  •Valeur is protected - select Yes to prevent the values hidden of manipulated when a page is posted.
  
  Question: How protected value Hidden Items work - that is to say, what is their semantics?
  
  Now, I am asking an intelligent question. I understand that "prevents the values hidden of manipulated when a page is published" means that the value cannot be changed. And I guess that 'Posted' means presented in Session State. (Failure of my search for a definition for 'post').
  
  So all this raises the question (s):
  Just when - made the page / page treatment - value a ' protected ' Hidden of the element can be changed?
  Exactly what event signals the beginning of the period where he can not be changed?
  This feature to protect the State from Session only or protecting the HTML value as well?
  Or are these not even the right questions?
  
  ???
  Howard

  Howard (in training) wrote:
  Paul,

  Great! Great! Very clear and very comprehensive.

  Re: In session state to the course to see the page or page accepts the treatment, but not by the user or the JavaScript changing the value in the browser page. (A dynamic Action or the application process can change the value using the code running on the server, but it would be crushed by the value of the page protected when the page is sent).

  Therefore assignments in dynamic Actions are counted as prevented changes/browser of the user. So, if I put in hidden point ': P3_HIDDEN: = 3; "in a browser of the user/a triggered a dynamic Action, that the value is submitted. I have it.

  No, you do not have it. Dynamic PL/SQL execute as action

  :P3_HIDDEN := 3;
  

  changes in the value of the session state is allowed (but this value will be replaced with the original if the page is sent). The dynamic equivalent operation to execute JS

  $s(':P3_HIDDEN', 3)
  

  is not allowed because it changes the value of the page , and an error occurs if the page is sent.

  Question: but what about 'treatment of the Page? More precisely, the different point and Validations Page postings? If they change a value of the element hidden Proteceted, is sent amended or rejected?

  Does not apply. The page has already been submitted. (The browser submits / messages page;) APEX it accepts). Looking for a track of debugging for a page accept action: the item values are copied in session state before the calculations, validations and the processes are executed.