Is it possible to generate a checksum on a URL before calling "f"

Question

I have an AJAX process which adds a number of additional arguments that get passed through the URL, i.e. "&argname=" that are not supported via htmldb_Get or the "f" procedure. As a work around I have created my own PLSQL wrapper around the function which has these additional arguments which works fine, and I simply alter the URL string i.e. "p" before calling the "f" procedure in this PLSQL wrapper.
However this will not work when session state protection is enabled as when I call "prepare_url" to generate a checksum on my newly altered URL it returns null as expected because I'm outside of the APEX engine. So the question is is there any way I can generate a checksum in this wrapper procedure. I have a valid APEX session and cookie can pass though all the needed details.... I have had a good look through the APEX API's but can't find anything. Can anyone help?

Answer 1

Hi Scott, it's Matt
Thnks mate, much appreciated for replying to this thread!
Essentially I have an authenticated APEX session and I'm doing an AJAX post to my own custom PLSQL wrapper procedure instead of using "f" as i have a number of arguments that do not match the signature of that procedure which are being generated by an external JS library API. I'm simply changing the URL that will be passed to it e.g. here's a cut down version of my procedure to give you an idea of what I'm doing...
create or replace PROCEDURE   FCUSTOM
( p                       IN VARCHAR2
, p_sep                   IN VARCHAR2 DEFAULT NULL
, p_trace                 IN VARCHAR2 DEFAULT NULL
, c                       IN VARCHAR2 DEFAULT NULL
, pg_min_row              IN VARCHAR2 DEFAULT NULL
, pg_max_rows             IN VARCHAR2 DEFAULT NULL
, pg_rows_fetched         IN VARCHAR2 DEFAULT NULL
, fsp_region_id           IN VARCHAR2 DEFAULT NULL
, success_msg             IN VARCHAR2 DEFAULT NULL
, notification_msg        IN VARCHAR2 DEFAULT NULL
, cs                      IN VARCHAR2 DEFAULT NULL
, s                       IN VARCHAR2 DEFAULT NULL
, callback                IN VARCHAR2 DEFAULT NULL
, totalrows               IN VARCHAR2 DEFAULT NULL
, sort                    IN VARCHAR2 DEFAULT NULL
, dir                     IN VARCHAR2 DEFAULT NULL
, app_id                  IN VARCHAR2 DEFAULT NULL
, page_id                 IN VARCHAR2 DEFAULT NULL
, session_id              IN VARCHAR2 DEFAULT NULL
, action                  IN VARCHAR2 DEFAULT NULL
) AS
  l_override        VARCHAR2(32767);
  l_fsp_sort        VARCHAR2(50);
  l_workspace_id    NUMBER;
  l_items           VARCHAR2(32767);
  l_item_values     VARCHAR2(32767);
BEGIN
  FOR c0 IN (SELECT workspace_id
             FROM   apex_applications
             WHERE  application_id  = app_id)
  LOOP
    l_workspace_id := c0.workspace_id;
  END LOOP;
  -- We need to do the following to access the apex data dictionary
  wwv_flow_api.set_security_group_id(l_workspace_id);
  Unfortunately you cannot access/set session state outside of the f function,
  i.e. if you wrapper around it as you essentially are unauthenticated/identified
  APEX_UTIL.SET_SESSION_STATE
  ('PAGINATION_CALLBACK_START',callback||'(');
  APEX_UTIL.SET_SESSION_STATE
  ('PAGINATION_CALLBACK_END',totalrows||')');
  IF action = 'Sort' THEN
    -- We need to lookup the column name to get the sequence id for the sort
    -- portion of the Apex page request e.g.
    -- FLOW_PPR_OUTPUT_R'+pId+'_'+pSort+'::RP&fsp_region_id='+pId;
    FOR c1 IN (SELECT 'fsp_sort_'||display_sequence||decode(dir,'DESC','_desc','') fsp_sort
               FROM   apex_application_page_rpt_cols
               WHERE  application_id  = app_id
               AND    page_id         = page_id
               AND    region_id       = fsp_region_id
               AND    column_alias    = sort)
    LOOP
      l_fsp_sort := c1.fsp_sort;
    END LOOP;
    -- We need to set the pagination function javascript callback via the URL
    -- as wen not set session state using API's
    l_override := p;
    l_override := regexp_replace(l_override,'FLOW_PPR_OUTPUT_R.*$', 'FLOW_PPR_OUTPUT_R'||fsp_region_id||'_'||l_fsp_sort||':NO:RP');
    l_items := ':PAGINATION_CALLBACK_START,PAGINATION_CALLBACK_END,GRID_SORT_COLUMN';
    l_item_values := callback||'(,'||totalrows||'}),'||sort;
  ELSE
    -- We need to set the pagination function javascript callback as we are expecting
    -- the JSON object to be wrapped in this callback function
    l_override := p||':';
    l_items := 'PAGINATION_CALLBACK_START,PAGINATION_CALLBACK_END';
    l_item_values := callback||'(,'||totalrows||')';
  END IF;
  -- Lets append the items and their values to the URL string
  l_override := l_override || ':' || l_items || ':' || l_item_values;
  f
  ( p                 => l_override
  , cs                => NULL
  , pg_min_row        => pg_min_row+1
  , pg_max_rows       => pg_max_rows
  , pg_rows_fetched   => pg_rows_fetched
  , fsp_region_id     => fsp_region_id
END;
grant execute on FCUSTOM to public
drop public synonym FCUSTOM
create or replace public synonym FCUSTOM for myuser.FCUSTOM
/And this works fine until I enable session state protection as set the page to require arguments with checksums, which I expected because I can't actually access session state as I'm outside of the apex engine in my wrapper procedure. I was just wondering if it's possible to run several APEX API calls which can check the validity of my session and cookie and allow me to run prepare_url and/or update session state values.
I'm thinking you're probably going to come back and say no as that would create a security vulnerability, but if you do could you explain why in a little detail, purely because I'm interested in knowing why when I have an authenticated APEX session and valid cookie?