Attachments Permissions Issue

Question

Hello,
We are trying to implement the attachment upload/download ability in our application, and we seem to have run into an issue.
The upload functionality works fine, as long as the user has the DBA role assigned to him. When the role is removed, though, we get a 404 Page Not Found error. The same error occurs even if the user is assigned direct rights to the wwv_flow_files view and its underlying table, and to the attachment table we use.
The unusual part of this situation is that when the user runs the code in Toad with or without the DBA rights, the code works fine.
If anyone has run across this kind of situation before, we would appreciate any advice. If you're curious, the uploading code is below.
Thanks,
Scott
/*This process uploads a file to the ISR_ATAT_ATTACHMENT table from the WWV_FLOW_FILES view,
which is the view that handles all the file uploading for HTML DB.
If the file doesn't have the same name as an existing file for the SDR, it is uploaded with no problems.
If the file DOES have the same name, it's assumed the files are the same, and the client is given the
option of stopping or overwriting the file.
If the client chooses to continue, the original file is deleted and the new file is uploaded in its
place.*/
DECLARE
xCOUNTER NUMBER;
BEGIN
IF :P73_FILE is not null THEN
   :P73_FILE_PATH := :P73_FILE;
   IF :F101_DUPLICATE_FILE != 'DUPLICATE_FILE' THEN
--Count the number of files associated with this SDR with the same name as the file being uploaded.
      SELECT
          count(ATAT_UID)
      INTO
          xCOUNTER
      FROM
          ISR_ATAT_ATTACHMENT
      WHERE
          ATAT_DESC = substr(:P73_FILE, instr(:P73_FILE, '/', -1) +1)
      AND OBOB_UID = :P73_OBOB_UID;
      IF xCOUNTER = 0 THEN
--This is a new file for this SDR, so upload it with no problems.
            INSERT INTO ISR.ISR_ATAT_ATTACHMENT
              (ATAT_ATTACHMENT,
               ATAT_DESC,
               OBOB_UID,
               KTTR_ATAT_CLASS_UID)
            SELECT
               BLOB_CONTENT,
               substr(:P73_FILE, instr(:P73_FILE, '/', -1) +1),
               :P73_OBOB_UID,
               :P73_KTTR_ATAT_CLASS_UID
            FROM
               wwv_flow_files
            WHERE NAME = :P73_FILE;         
            delete WWV_FLOW_FILES where NAME = :P73_FILE;
            :F101_DUPLICATE_FILE := 'NOT_DUPLICATE';
      ELSE
          --It's a duplicate file and they should be warned.
            --F101_DUPLICATE_FILE sets the display on various items throughout the page.
         :F101_DUPLICATE_FILE := 'DUPLICATE_FILE';                
      END IF;
   ELSE
           --It's a duplicate file, and they are overwriting the old file anyway.
            delete
                ISR_ATAT_ATTACHMENT
            where
                ATAT_DESC = substr(:P73_FILE, instr(:P73_FILE, '/', -1) +1)
            and OBOB_UID = :P73_OBOB_UID;
            INSERT INTO ISR.ISR_ATAT_ATTACHMENT
              (ATAT_ATTACHMENT,
               ATAT_DESC,
               OBOB_UID,
               KTTR_ATAT_CLASS_UID)
            SELECT
               BLOB_CONTENT,
               substr(:P73_FILE, instr(:P73_FILE, '/', -1) +1),
               :P73_OBOB_UID,
               :P73_KTTR_ATAT_CLASS_UID
            FROM
               wwv_flow_files
            WHERE NAME = :P73_FILE;
            delete WWV_FLOW_FILES where NAME = :P73_FILE;
            :F101_DUPLICATE_FILE := 'NOT_DUPLICATE';
   END IF;
ELSE
   IF :F101_DUPLICATE_FILE = 'DUPLICATE_FILE' THEN
           --It's a duplicate file, and they are overwriting the old file anyway.
            delete
                ISR_ATAT_ATTACHMENT
            where
                ATAT_DESC = substr(:P73_FILE_PATH, instr(:P73_FILE_PATH, '/', -1) +1)
            and OBOB_UID = :P73_OBOB_UID;
            INSERT INTO ISR.ISR_ATAT_ATTACHMENT
              (ATAT_ATTACHMENT,
               ATAT_DESC,
               OBOB_UID,
               KTTR_ATAT_CLASS_UID)
            SELECT
               BLOB_CONTENT,
               substr(:P73_FILE_PATH, instr(:P73_FILE_PATH, '/', -1) +1),
               :P73_OBOB_UID,
               :P73_KTTR_ATAT_CLASS_UID
            FROM
               wwv_flow_files
            WHERE NAME = :P73_FILE_PATH;
            delete WWV_FLOW_FILES where NAME = :P73_FILE_PATH;
            :F101_DUPLICATE_FILE := 'NOT_DUPLICATE';
   END IF;
END IF;
END;

Answer 1

Hi Scott S.
This is how our DADS are setup;
                <Location /pls/ISR01TS_htmldb>
                 SetHandler pls_handler
                 Order deny,allow
                 Allow from all
                 AllowOverride None
                 PlsqlDatabaseUsername      HTMLDB_PUBLIC_USER
                 PlsqlDatabasePassword      @xxxxxxxxxxxxxxxxx=
                 PlsqlDatabaseConnectString apus:1521:ISR01TS.world ServiceNameFormat
                 PlsqlDefaultPage           htmldb
                 PlsqlDocumentTablename     wwv_flow_file_objects$
                 PlsqlDocumentPath          docs
                 PlsqlDocumentProcedure     wwv_flow_file_manager.process_download
                 PlsqlAuthenticationMode    Basic
                 PlsqlNLSLanguage           AMERICAN_AMERICA.US7ASCII
                 PlsqlMaxRequestsPerSession 1
                </Location>
                <Location /pls/ISR01TS>
                 SetHandler pls_handler
                 Order deny,allow
                 Allow from all
                 AllowOverride None
                 PlsqlDatabaseConnectString apus:1521:ISR01TS.world ServiceNameFormat
                 PlsqlDefaultPage           htmldb
                 PlsqlDocumentTablename     wwv_flow_file_objects$
                 PlsqlDocumentPath          docs
                 PlsqlDocumentProcedure     wwv_flow_file_manager.process_download
                 PlsqlAuthenticationMode    Basic
                 PlsqlNLSLanguage           AMERICAN_AMERICA.US7ASCII
                </Location>
                <Location /pls/ISR01DV_htmldb>
                 SetHandler pls_handler
                 Order deny,allow
                 Allow from all
                 AllowOverride None
                 PlsqlDatabaseUsername      HTMLDB_PUBLIC_USER
                 PlsqlDatabasePassword      @xxxxxxxxxxxxxxxxxxxxx=
                 PlsqlDatabaseConnectString apus:1521:ISR01DV.world ServiceNameFormat
                 PlsqlDefaultPage           htmldb
                 PlsqlDocumentTablename     wwv_flow_file_objects$
                 PlsqlDocumentPath          docs
                 PlsqlDocumentProcedure     wwv_flow_file_manager.process_download
                 PlsqlAuthenticationMode    Basic
                 PlsqlNLSLanguage           AMERICAN_AMERICA.US7ASCII
                </Location>
                <Location /pls/ISR01DV>
                 SetHandler pls_handler
                 Order deny,allow
                 Allow from all
                 AllowOverride None
                 PlsqlDatabaseConnectString apus:1521:ISR01DV.world ServiceNameFormat
                 PlsqlDefaultPage           htmldb
                 PlsqlDocumentTablename     wwv_flow_file_objects$
                 PlsqlDocumentPath          docs
                 PlsqlDocumentProcedure     wwv_flow_file_manager.process_download
                 PlsqlAuthenticationMode    Basic
                 PlsqlNLSLanguage           AMERICAN_AMERICA.US7ASCII
                </Location>We are accessing the DAD that does not use the HTMLDB_PUBLIC_USER. This causes the browser to prompt for a login. We enter a username and password that is a valid database account. If the account has the DBA role it works if it does not have the DBA role it fails.
This is how our Authentication is set in both Development and Test
Authentication Schemes    Create Scheme > 
Edit Name Description Flow Chart Status
DATABASE Use database authentication (user identified by DAD).  (current)
HTML DB Use internal HTML DB account credentials and login page in this application.  make current
  row(s) 1 - 2 of 2