Securing Procedure Called from URL

Hello all,
I've read-up on creating procedures that can be called directly via a URL (ie. http://localhost:8080/apex/myschema.helloworld) by granting execute to anonymous and adding "MYSCHEMA.HELLOWORLD" to wwv_flow_epg_include_mod_local. I have a test procedure running.
My question is, does anyone have any suggestions on how one might do this securely? Specifically I'm thinking I'd like to use one of these procedures to generate an XML stream of location information into a Google Map on one of my pages. As long as a user is in the app, I'm good because I know the user logged-in to get there. My concern is that some smart guy would get hold of the URL, pop it in the address bar and now has all the location data which may be sensitive.
Couple things I tried:
- granting execute to just apex_public_user incorrectly thinking that's what an ApEx application runs as (I forgot it runs as anonymous which is the same as someone who isn't logged in at all)
- checking the value of v('APP_SESSION') inside the procedure, thinking if there's a session then the user must have logged-in - but it comes back null whether called from inside or outside the application. I suspect that when calling the procedure via a URL even from inside the app (like thru an iframe in an HTML region), it must kick off a new session.
Any thoughts or suggestions, even something other than using a direct procedure call at all? My main priority is doing this securely.

Hi,
I have had similar requirements. I'm not sure I've solved it properly yet, but here's the sort of thing I did:
1 - I updated the procedure to receive a parameter - this will be the ID of the user
2 - In my database, I created a table that holds nothing but the IDs and a datetime value.
3 - When the page loads that the user uses to get to this procedure, I update datetime value for the record for that user to, say, now + 1 minute
4 - When called, the procedure then checks the ID in that table to see if the datetime value is > now - if it is, then the download proceeds, otherwise, nothing
You could probably also do something with a random number created when the page loads. Pass this as another parameter and check it in the process.
Andy

Similar Messages

Stored Procedure call from JDBC sender for Oracle Database

Hi,
I have a requirement to call stored procedure using JDBC sender adapter for retriving data from an Oracle database.
I need to execute first stored procedure call from Querry SQL statement and then trigger second stored procedure call for confirming the succesful retrival of those records from the update SQL statement.
Querries:
1. Can we trigger stored procedure from Update statement of JDBC sender.
2. Can we call stored procedure from Querry statement, since I have read on other sdn threads that stored procedure calls on Oracle database are not allowed. If not possible to have "Execute stored procedure" would the function call (select * from table(function name)) work same as stored procedure.
3. In a JDBC sender the Querry statement and Update statement are executed in same session call and same database connection. What happens if the querry statement was not succesful, would the update be still triggered.
Please note PI does not have direct access to main table and hence the need to have separate stored procedure calls.
The PI version is PI 7.11 sp4.
Appreciate your inputs.
Thanks.
Siddhesh S.Tawate

>1. Can we trigger stored procedure from Update statement of JDBC sender.
I think not possible using update statement.
> Can we call stored procedure from Querry statement, since I have read on other sdn threads that stored procedure calls on Oracle database are not allowed. If not possible to have "Execute stored procedure" would the function call (select * from table(function name)) work same as stored procedure.
Yes using select query you can call stored procedure.
>. In a JDBC sender the Querry statement and Update statement are executed in same session call and same database connection. What happens if the querry statement was not succesful, would the update be still triggered.
No select and update handles in the same session using the same thread so if one transaction fails update should not proceed.

Execution Times of Stored Procedures Called from Other Stored Procedures

If I execute sys.dm_exec_procedure_stats, it will produce execution times of my stored procedures executed recently.
However, stored procedures called from other stored procedures do not show up.
Is there code that can return the execution times of stored procedures even though they are called from other stored procedures.

Look at the example. It is counting nested execution.
CREATE PROC z1SP AS SELECT * FROM Production.Product;
GO
CREATE PROC z2SP AS SELECT * FROM Production.Product WHERE Color is not null; EXEC z1SP;
GO
SELECT object_name(2002822197), object_name(2034822311);
--z1SP z2SP
EXEC z1SP; EXEC z2SP;
GO 10
SELECT * from sys.dm_exec_procedure_stats
database_id object_id type type_desc cached_time last_execution_time execution_count
16 2002822197 P SQL_STORED_PROCEDURE 2014-12-16 13:02:45.170 2014-12-16 13:02:46.717 20
16 2034822311 P SQL_STORED_PROCEDURE 2014-12-16 13:02:45.460 2014-12-16 13:02:46.687 10
Kalman Toth Database & OLAP Architect
SQL Server 2014 Database Design
New Book / Kindle: Beginner Database Design & SQL Programming Using Microsoft SQL Server 2014

Secured JDBC call from PI

Hi,
Please let me know the possibilities of secured JDBC call from PI. In JDBC adapter configuration, is it possible to achieve secured connection to Database server?
I saw few similar threads in Forums but did not get much information.
Thanks,
Geetha

?Please let me know the possibilities of secured JDBC call from PI. In JDBC adapter configuration, is it possible to achieve secured connection to Database server?
Yes, it is absolutely possible to secure the jdbc connection to database server. You might have to do few things...
Please follow this link
http://wiki.sdn.sap.com/wiki/display/XI/EncryptioninscenariosinvolvingJDBCAdapterwithOracleDatabase
You can encrypt all the connection parameters including user name and password between jdbc adapter and database server. Use advance tab and do the recommended changes given in the above link.Similarly on the database server you have to do the same. You might have to take help from dba to set the similar settings on the database level too.

Need to do a commit in a procedure called from a trigger

How do I get around the need to do a commit in a procedure that is being executed from a trigger. I know it can't be done but I bet someone has a workaround. Thanks.

Hi
Why do you want to do a commit in a procedure called from a trigger?
Anyway if you are running Oracle 8i+ you can declare the procedure as an Autonomous Transaction and can issue a commit, eventhough it is called from a trigger.
HTH
Arvind Balaraman

I need to use a reserved word as parameter name in proc called from URL

Let me preface this post by saying I already know this is terrible to attempt, but it's short term fix only.
Ok, so I have to create a procedure that will be called by a vendors application via a API that calls our URL to send data over. The terrible part is
that the API they have uses the parameter FROM=vendor_data A change is on the way so in the future the API won't use FROM as a paramter, so this isn't something I want to do, but it's a workaround.
So the nastiness is this..., I can create a procedure that'll compile when I enclose FROM in double quotes "FROM" as my input parameter
but if I try to call my procedure via URL (as their application will do) the procedure isn't working. I searched for someway to do an inline
replace of the FROM parameter to something else, but no luck. I'm open to all positive comments. I cannot go outside of Oracle
to do this, so I can't call a shell script and replace. Basically I need some way to use a reserved word as a parameter name, and then be able to call
that proc from a URL, or someway to change the FROM in the URL inline. Any help on this admittedly whacky situation would be appreciated much.
I tried ...\myproc?from=text
...\myproc?"from"=text
...\myproc?'from'=text
proc is simple test procedure
create or replace procedure myproc
("from" in varchar2 default 0)
is
v_from varchar2(30);
begin
v_from:="FROM";
insert into test(col1) values(v_from);
end;
**** Update
I didn't get any more replies but came to a solution that I thought I'd post. It's much better, more elegant and maybe can help others.
So instead of using FROM as the parameter name I did some research and decided I can use flexible parameters. Basically you end up having
2 input parameters for a procedure, one holds a parameter name the other holds the parameter value. They get loaded into arrays
and you access the values with regular name_array(1), value_array(1), etc. ?v=parameter&v2=value
Once I figued I could use flexible parameter it took me tons of research to find out the actual syntax. I'll post some examples for others
later, but was suprised with the lack of resources consideriing how "flexible" they are.
Thanks again for the replies. Cheers.
Edited by: Mitz on Jul 29, 2009 11:37 PM

Scott,
Thanks for the reply. I'm not familiar with the wwv_flow_epg_include_mod_local, however I know that the
myproc is available via URL. I passed the my procedure name(myproc) on to the dba a while back to make it "accessible" so, I'm assuming that he
added it to this the www_flow_epg_mod_local (assuming this has something to do with access control).
If I modify myproc procedure and remove "FROM" as the input variable, and replace with say,
IN_FROM I can then call the procedure via the URL ./myproc?in_from=test without any problems.
I'm pretty confident that it's the "FROM" that is the hurdle and not a security or setup issue. The proc is fine to call from the URL until I got the curveball that the only available parameter was FROM. How the URL should be when inputing to that parameter?
Edited by: Mitz on Jul 25, 2009 7:36 PM
Edited by: Mitz on Jul 25, 2009 9:16 PM

Securing webservice call from to siebel

Hi,
We have implemented OPA with siebel integration, where in we launch OPA from siebel.OPA calls a webservice on siebel which fetches data from siebel. We want that weservice call to be secured i.e. to use https and not http. Anybody have any idea in doing this. The url in siebel-data-adapter file has to be https and not http.

Ecstasy wrote:
Hi,
We have implemented OPA with siebel integration, where in we launch OPA from siebel.OPA calls a webservice on siebel which fetches data from siebel. We want that weservice call to be secured i.e. to use https and not http. Anybody have any idea in doing this. The url in siebel-data-adapter file has to be https and not http.There are two parts to solving this problem.
Part 1: ( setting up the Siebel Inbound web service so it runs through HTTPS. You should consult the Siebel documentation for this and it will require running HTTPS with a certificate through something like apache or IIS (for windows).
Part 2: Once you have the inbound web services running under HTTPS, you can set the URL in the siebel-data-adapter properties to point to the HTTPS service, however, when you make a call from Web Determinations to Siebel. It will probably fail with a an exception. This will probably happen if you have used an self-signed or untrusted certificate.
The second part of this problem is setting up the java run-time environment to accept the certificate that the HTTPS service is using (set up under part 1). There are several different ways of doing this, but I found the following the easiest.
1. get the public part of the certificate.
2. create a keystore/truststore and add that certificate (or add to existing keystore).
3. point the jvm to that truststore , You do this through setting java system properties.
Example Java properties
In the example below, I have put the public certificate into a keystore called "siebel_wd_keystore" and I want to point my apache-tomcat to use that as a trust store. The system properties that need to be set are as follows.
-Djavax.net.ssl.trustStore="C:\trust_store\siebel_wd_keystore"
-Djavax.net.ssl.trustStorePassword=siebel Because this is tricky there is a very useful system property that you can set, that will give you lots of debugging information about SSL. If its not working, setting this property give you a lot more information in your logs.
-Djavax.net.debug=sslIf the setting above doesnt seem to give you more information, thats probably a sign that you aren't setting the system properties correctly for your application server.

MS SQL Procedure Call from Oracle Database

I have Oracle Database 11g connected to MS Sql Server 2008 via dg4msql, and need to execute procedure on MS Sql with parameters from Oracle, and get dataset (table) as a result.
I'm not sure is it possible to call procedure directly from Oracle; One solution would be make function on MS SQL, and put select on procedure from Oracle, but what with parameters?
Is there some possibility to call this procedure from Oracle and get this dataset as a cursor?
Thanks in advance!
Edited by: mihaelradovan on 2012.04.26 14:35

Yes, of course I have DB Link in Oracle and procedure in SQL Server.
Btw, I can select data from SQL Server table.
I made one function in SQL Server, and I can not make select on this function, but in SQL Server I made view as select * from function_name, and select on this view from Oracle works. But problem is I have to call this procedure or function with parameters, and with view I can not do this.
So, I must call procedure or function with parameters directly. I made all by the book (Oracle® Database Gateway for SQL Server User’s Guide), but probably I miss something...

Passing UDT TABLE of VARCHAR as an Input parameter in Stored procedure call from java

I have following Type defined at the schema: ident_arr IS TABLE OF VARCHAR2(100) which is type of one of the input parameters. I am able to create oracle.sql.ARRAY object to map it with this UDT before calling my stored procedure from java. When I execute my stored procedure, I get the following error:
ORA-06550: line 1, column 7:
PLS-00306: wrong number or types of arguments in call to 'P_PV_WCC_INSERT'
ORA-06550: line 1, column 7:
PL/SQL: Statement ignored
I have already checked all other parameter types.

Hello,
Thank you, guys, for advice. I should have explained calling context before, but what I basically need to do is to see if procedure(arg1, list(record(arg2, arg3))) returns true.
I see array binding wouldn't fit there nicely. Internal procedure calls would be proc(next(arg1), next(arg2), next(arg3)) - if all these return true, external call should also return true. I would need to make a list of repeating values of arg1 and separate list(record(arg2, arg3)) into separate lists. I would also need to record whether the internal call returns true to deduce whether external call returns true.
As I see no better way yet, I'll make Oracle procedure proc(arg1, arg2, arg3) and implement a loop in .NET side. If I optimize for performance, I'll probably pack the array of records into string and pass it for Oracle side to parse.
Regards,
Aurimas Pranskevicius

Common procedure call from db trigger.

hi all,
i have one procedure, which is called from most of the db-triggers on tables.
while dml operation, db-trigger on table calls this common procedure.
while executing this procedure, i want to know currently, it is called from which trigger and table.
is it possible?
regards.

in that case i have to modify all the triggers on table, which is labourious job.
any other solution.

Database procedure called from Forms

If a database procedure that updates a table is called from Oracle Forms, does it commit the changes automatically or do you have to issue a commit in Forms to commit the changes the database procedure has done, assumming there is no commits in the database procedure.
I'm not sure since I have seen cases where a commit was needed after the database procedure has been called and a case where a commit was needed. I checked the database procedure and there was no commits, there was a commit above the statement where the procedure was being called.

<BLOCKQUOTE><font size="1" face="Verdana, Arial">quote:</font><HR>Originally posted by NAB ():
If a database procedure that updates a table is called from Oracle Forms, does it commit the changes automatically or do you have to issue a commit in Forms to commit the changes the database procedure has done, assumming there is no commits in the database procedure.
I'm not sure since I have seen cases where a commit was needed after the database procedure has been called and a case where a commit was needed. I checked the database procedure and there was no commits, there was a commit above the statement where the procedure was being called.<HR></BLOCKQUOTE>
Database procedure do have commit. You can issue commit in the procedure itself.
null

How to open a MD form in insert mode when calling from URL ?

I have a MD form and I want to open it in 'insert' mode when I click on the URL.
How can I do that ?
thanks,
Mainak

I think somebody has asked the same questions earlier but I cannot find the link to that message. Please can anyone help me ?
How to open a form in Insert mode from url link ?
Mainak

Error Message from Oracle server while a procedure calling from VB

hi,
when i am calling a procedure some time an error is comming and most of the times the program is working properly. the error showing is as folows
ORA-06550: line 1, column 7:
PLS-00306: wrong number of type of arguments in call to 'PRO_PandL_Exp1'
ORA-06550: line 1, column 7:
PL/SQL:Statement Ignored
i am expressing my extreem thanks for trying to help me and solve the problam
the procedure i written is
CREATE OR REPLACE PROCEDURE PRO_PANDL_EXP1
(companyid in number, Stdate in varchar2, enddate in varchar2, YEARID in number, p_recordset OUT SYS_REFCURSOR ) AS
sdate date;
edate date;
begin
sdate := to_date(Stdate,'dd-mon-yyyy');
edate := to_date(enddate,'dd-mon-yyyy');
open p_recordset for select NVL(sum(dr),0) AS DR , NVL(sum(cr),0) AS CR , NVL(sum(opamt),0) AS OPAMT,
NVL(sum(balamt),0) AS BALAMT, group_name, ORDER_TO_PRINT, GROUP_LEVEL,
TR_PL_BS_FLAG, ag.GROUP_ID, head_status as Head_id, Head_name,
nvl(Details.GROUP_NATURE, ag.group_nature) as GROUP_NATURE,
nvl(Details.parent_id1, ag.parent_id1) as Parent_id1
from (
(SELECT SUM(nvl(MONTHBALANCEAMTDR, 0)) AS DR,
SUM(nvl(MONTHBALANCEAMTCR, 0)) AS CR,
SUM(nvl(OPBALANCEAMT, 0)) AS OPAMT, SUM(nvl(balance,
0)) AS balAmt, group_id, DTL.head_id,
DTL.head_status, DTL.head_name,
DTL.GROUP_NATURE, parent_id1
FROM ( SELECT SUM(nvl(MONTHBALANCEAMTDR, 0))
AS MONTHBALANCEAMTDR,
SUM(nvl(MONTHBALANCEAMTCR, 0))
AS MONTHBALANCEAMTCR, SUM(nvl(OPBALANCEAMT,
0)) AS OPBALANCEAMT, SUM(nvl(balance, 0))
AS balance, groupdetails.group_name,
groupdetails.group_id AS group_id,
groupdetails.head_id AS head_id,
GROUPDETAILS.HEAD_NAME,
groupdetails.head_status, PARENT_ID1,
ORDER_TO_PRINT, GROUP_NATURE
FROM (SELECT SUM(NVL(MONTHBALANCEAMTDR, 0)) AS MONTHBALANCEAMTDR,
SUM(NVL(MONTHBALANCEAMTCR, 0)) AS MONTHBALANCEAMTCR, head_id, HEAD_NAME,
group_ID, COMPANY_ID FROM (SELECT SUM(DECODE(DRCR, 0, (AMOUNT_IN_AED+nvl(CON_RATE_DIFF,0)),
0)) AS MONTHBALANCEAMTDR,
SUM(DECODE(DRCR, 1, (AMOUNT_IN_AED+nvl(CON_RATE_DIFF,0)), 0))
AS MONTHBALANCEAMTCR, AH.head_id,
AH.HEAD_NAME, AH.group_ID,
AH.COMPANY_ID
FROM federal.TRANS_DETAILS TD,
federal.account_heads AH
WHERE VOUCHER_DATE <= edate AND
VOUCHER_DATE >= sdate AND
AH.COMPANY_ID = TD.COMPANY_ID AND
AH.head_id = TD.head_iD AND
ah.company_id = companyid
GROUP BY DRCR, AH.group_id, AH.head_id,
AH.COMPANY_ID, AH.HEAD_NAME)
GROUP BY group_id, head_id, COMPANY_ID, HEAD_NAME )
transdetails,
(SELECT SUM(nvl((AMOUNT_IN_AED+nvl(CON_RATE_DIFF,0)), 0))
AS OPBALANCEAMT, AH.head_id,
AH.HEAD_NAME, AH.group_ID,
AH.COMPANY_ID
FROM federal.TRANS_DETAILS TD,
federal.account_heads AH
WHERE VOUCHER_DATE < sdate AND
AH.COMPANY_ID = TD.COMPANY_ID AND
AH.head_id = TD.head_iD AND
ah.company_id = companyid
GROUP BY AH.group_id, AH.head_id,
AH.COMPANY_ID, AH.HEAD_NAME)
OPENINGDETAILS,
( SELECT ah.head_id, DECODE(group_level, 1,
ah.head_id, 0) AS head_status,
0 AS BALANCE, accountgroup.company_id, accountgroup.group_id, parent_id2,
group_name, DECODE(group_level, 1, ah.head_name, ' ') AS head_name, ORDER_TO_PRINT,
GROUP_NATURE, parent_id1
FROM FEDERAL.account_heads AH,
(SELECT group_id, group_name, group_level, company_id, parent_id2, parent_id1,
ORDER_TO_PRINT, GROUP_NATURE
FROM FEDERAL.account_groups AG
WHERE AG.company_id = companyid and (GROUP_NATURE='I' or GROUP_NATURE='E' or GROUP_NATURE='P') )
accountgroup
WHERE AH.group_id = accountgroup.group_id AND
AH.company_id = accountgroup.company_id AND
AH.company_id = companyid) groupdetails
WHERE transdetails.head_id (+) = groupdetails.head_id AND
transdetails.company_id (+) = groupdetails.company_id AND
OPENINGdetails.head_id (+) = GROUPDETAILS.head_id AND
OPENINGdetails.company_id (+) = GROUPDETAILS.company_id
GROUP BY groupdetails.group_name, head_status,
groupdetails.group_id, groupdetails.head_id,
GROUPDETAILS.HEAD_NAME,
GROUPDETAILS.group_id, PARENT_ID2, head_status,
ORDER_TO_PRINT, GROUP_NATURE, parent_id1) DTL
GROUP BY group_id, DTL.head_id, DTL.head_name,
DTL.head_status, DTL.GROUP_NATURE, parent_id1)
UNION ALL
(SELECT DISTINCT
0, 0, 0, 0, accountgroup.group_id, 0 AS head_id,
0 AS head_status, ' ' AS head_name, GROUP_NATURE, parent_id1
FROM FEDERAL.account_heads AH,
(SELECT group_id, group_name, group_level, company_id,
parent_id1, ORDER_TO_PRINT, GROUP_NATURE
FROM FEDERAL.account_groups AG
WHERE AG.company_id = companyid and group_level<=2 and (GROUP_NATURE='I' or GROUP_NATURE='E' or GROUP_NATURE='P') ) accountgroup
WHERE AH.group_id = accountgroup.group_id AND
AH.company_id = accountgroup.company_id AND
AH.company_id = companyid AND
accountgroup.group_id = ah.group_id ) ) Details,
account_groups AG where Details.group_id (+) = AG.Group_id and AG.GROUP_LEVEL <=2 AND
ag.company_id = companyid group by
group_name, ORDER_TO_PRINT, GROUP_LEVEL, TR_PL_BS_FLAG, ag.GROUP_ID,
head_status, Head_name, Details.GROUP_NATURE, Details.parent_id1 , ag.GROUP_NATURE, ag.parent_id2, ag.parent_id1
order by parent_id1, GROUP_ID, ORDER_TO_PRINT, head_status, head_name ;
end pro_pandl_Exp1;
Thank you
Bosemon

prakash wrote:
Hi all,
DECLARE
l_conn UTL_TCP.connection;
BEGIN
l_conn := ftp.login('Destination Ip address ', '22', 'Username', 'Password');
ftp.ascii(p_conn => l_conn);
ftp.put(p_conn      => l_conn,
p_from_dir => 'MID5010_DOC1TEMP', -- Oracle Directory name from where we need to copy a file
p_from_file => 'Hipaa.33KM.5093.06152011130146885.834.O.irl',
p_to_file   => '/qatest1/mihipaa5010/mj5010/DevelopmentStage/working_directory/Outbound/Data/75061252/Hipaa.00AN.07262011173844778.820.O.copied.irl'); -- Directory of the destination machine where we need to paste
ftp.logout(l_conn);
exception
when others then
dbms_output.put_line(sqlcode || sqlerrm);
--dbms_output.put_line(l_conn);
END;We are getting the below error:
SSH-1.99-OpenSSH_5.1
-29260ORA-29260: network error: TNS:connection closed
Could any one please let us know why this error is raising...As sybrand correctly points out, this issue doesn't belong here.
You are using a 3rd party package "ftp" and the error it is indicating suggests the issue is a network issue of some sort.
We don't have the code of that package or know what it is doing, so please consult whoever supplied or wrote the package and/or your network administrators.

Stored Procedure Call from XMII

Hi, I am facing the following problem.
My SQL Stored Procedure has one input parameter,and it returns three values.
I want to know the syntax for calling this stored procedure ie. syntax in fixed query in XMII.
Thanks.

Hi Adam,
I assume that you are using MSSQL server stored procedure which outputs 3 values.
Say that you are inputting 1 integer @inval and returning 3 integer values @outval1, @outval2, @outval3 from Stored Procedure
Then perform the following in Query Template
DECLARE @val1 INT
DECLARE @val2 INT
DECLARE @val3 INT
EXEC StoredProcedureName
    @inval = 10,
    @outval1 = @val1 OUTPUT,
    @outval2 = @val2 OUTPUT,
    @outval3 = @val3 OUTPUT
SELECT @val1,@val2,@val3
Use FixedQuery mode
Regards,
Adarsh
Edited by: Adarsh Sidnoor on Aug 27, 2009 7:46 PM
Edited by: Adarsh Sidnoor on Aug 27, 2009 7:47 PM

External Procedure call from Trigger

I'd like to call an external C Procedure from
an Oracle Trigger.
In trying to get an example to work, after setting up the listener and tnsnames.ora for external procedures, the following SQL*Plus command behaves strangely:
CREATE LIBRARY TTest as "c:\winnt\system32\TTrigger.dll";
After entering this, the command line prompts for more data as if the command was not terminated. Tried single quotes, double quotes, forward slash, backward slash...
What is wrong with this command?
Thanks

hi,
COuld you send me the configuration parameters for listner and TNSNAMES? I am working so hard to set it up but getting stuck and I am sure that I am missing some configuration set up.
Please could you mail your tnsname a nd listner files to bellow shown address?
[email protected] ?
Thanks in advance
Suresh

Securing Procedure Called from URL

Similar Messages

Maybe you are looking for