Downloading BLOB from a table.

Question

Hello,
First I want to say thatnks for such a great tool like HTMLDB.
Question is:
How do I download BLOB from a table. What I am trying to do is. I am uploading files to a default HTMLDB location (wwv_flow_file_objects$) and moving the records to different table (delete file from wwv_file_objects$). Then I would like to be able to download that blobs from a DB by following some link. And I need it to be secure, user have to authenticate to do it. I got to the point where I created process (before header) to download the file. But I am having hard time passing some variables to that process in URL. Can some one advice me on the best practice of doing it. And also if it is a right thing to use before header process to put my own header and start uploading blob in html db. The main reason I do not whant to use DAD for that is simple security issue and ability of storing of the BLOBs only in one table. I prefer to upload it to a temporary location and then move it to other table(s). Then I need to be able to retriev the files back from those tables without moving them around.
Any help is greatly appriciated

Answer 1

i think i see what you're asking, but i'll step through the pieces just to make sure i cover your issue:
it sounds as if you have a procedure that successfully calls wpg_docload.download_file to get your blob out of your images table. for this explanation, lets just say your images table has the same table structure as wwv_flow_files created with something like...
create table myfiles as select * from wwv_flow_files where rownum < 3;
....and let's say your download proc that passed the blob from your myfiles table to wpg_docload.download_file looked something like...
create or replace procedure getmyfile(
p_id in varchar2,
p_mime_type in varchar2 default null)
as
l_lob blob;
l_mimetype varchar2(48);
l_mime_charset varchar2(255);
l_filename varchar2(400);
begin
select mime_type, blob_content, filename, file_charset
into l_mimetype, l_lob, l_filename, l_mime_charset
from myfiles
where id = p_id;
if l_mime_charset is not null then
owa_util.mime_header( l_mimetype, FALSE, l_mime_charset );
else
owa_util.mime_header( l_mimetype, FALSE );
end if;
htp.p('Content-length: ' || dbms_lob.getlength( l_lob ));
htp.p('Content-Disposition: attachment; filename="' ||
wwv_flow_utilities.escape_url( p_url => l_filename, p_url_charset => 'utf-8') || '"');
owa_util.http_header_close;
wpg_docload.download_file( l_lob );
end;
...then it sounds as if this is where you start running into issues. to be able to call this procedure from the url, you'd have to grant execute on your getmyfile proc to the db user that your modplsql DAD uses to access your db. once that user was given access to run getmyfile, you could access your files in myfiles by calling a URL like...
http://myserver.com/pls/mydad/myschema.getmyfile?p_id=1005529367869246
...where p_id is the unique id associated with your blob in getmyfiles (you could, of course, use whatever method you want to uniquely identify that file and adjust your select-into statement w/in your getmyfile procedure). so that's all fine and dandy, but it sounds as if you want users to have to authenticate into your html db application before they can access a blob in your images table. it also sounds as if you're on the right track to do so by putting your procedure call in a before_header html db process. you could quite easily call your getmyfile procedure in such an html db pl/sql before_header process with something like...
begin
getmyfile (p_id => 1008411584930314);
end;
...which would cause your page to just show the blob associated with the id you passed to getmyfile. because you're now accessing your blob table through html db parsing as your application schema owner, you'd no longer need to grant execute on getmyfile to your modplsql DAD's db user. that eliminates most of the security hole to which you were referring. now that you're calling getmyfile from w/in an html db process, you can take advantage of all the other html db perks such as applying conditions and an authorization scheme to the html db process to really lock things down. finally, you asked about firing your process before_header versus other firing points. before_header is a good way to go, but if you really wanted to execute other procedural logic on your page before showing the blob (and you didn't want to implement that code as before_header processes that fire sequentially before your getmyfile call),you could just throw an htp.init in right before your getmyfile call to clear out your http buffer like so...
begin
htp.init;
getmyfile (p_id => 1008411584930314);
end;
...hope this helps,
raj