Portal.wwdoc_document Access

Question

Hi all,
I am trying to write a SQL script that I can use in conjunction with Oracle Reports (Portal). I want this script to show all new documents uploaded by anyone in a page group. When I run the script from my Desktop app, I see everyone’s document. When I run the script in the portal, I only see the documents that I uploaded – no one else’s. It looks like I am running into some kind of permissions issue.
Is there any other way around this issue using Oracle Reports? I know I can probably use the Omni Portlet or maybe a PL/SQL item.
Here is the script:
select
'<a href="/portal/page?_pageid='
  || replace(security_object_name, '/', ',')
  || '&_dad=portal&_schema=PORTAL target="_blank">'
|| real_filename || '</a>   ' as real_filename /* Creates link to the parent page */
, replace(creator, '.', ' ') as creator
, last_updated
, NVL(SUBSTR(to_char(doc_size/1000), 0, INSTR(to_char(doc_size/1000), '.')-1),0) || ' KB'
as doc_size
, SUBSTR(security_object_name, 0, INSTR(security_object_name, '/')-1) as security_object_name
from portal.wwdoc_document
where trunc(last_updated) >= (trunc(sysdate)-7)
and SUBSTR(security_object_name, 0, INSTR(security_object_name, '/')-1) = '73' /* Page Group */
order by last_updated desc
One thing to note that I noticed in another post is that this table is not governed by portal ACLs.
Re: APIs for downloading content

Answer 1

So it looks like it is the view - but there is something off in this view and actual access the individual has. It seems to just join on username and miss group associations.
select "SUBSCRIBER_ID","NAME","PATHID","FILENAME","REAL_FILENAME"
,"MIME_TYPE","DOC_SIZE","DAD_CHARSET","LAST_UPDATED","CONTENT_TYPE"
,"BLOB_CONTENT","CREATOR","SESSION_ID","LANGUAGE","REFCOUNT"
,"SECURITY_OBJECT_TYPE","SECURITY_OBJECT_NAME","DAV_ID"
,"DAV_LOCK_TOKEN","DAV_OWNER","EXPIRE_SECONDS"
from wwdoc_document$ a
where (EXISTS (
               select 1 from wwsec_sys_priv$ b
               where b.object_type_name = 'DOCUMENT'
               AND b.name = a.name
               AND b.owner = upper('portal')
               AND b.grantee_type = 'USER'
               AND b.grantee_group_id = 0
               AND b.grantee_user_id in ( wwctx_api.get_user_id(), 2) --user PUBLIC
     OR (EXISTS (
               select 1 from wwsec_sys_priv$ b, wwsec_flat$ c
               where b.object_type_name = 'DOCUMENT'
               AND b.name = a.name
               AND b.owner = upper('portal')
               AND b.grantee_type = 'GROUP'
               AND b.grantee_group_id = c.group_id
               AND c.person_id = wwctx_api.get_user_id()
               AND b.grantee_user_id = 0 ) )