Security issues to consider with download links

Question

Hello,
I'm following the "How to Upload and Download Files in an Application" section of the Advanced Tutorial for APEX. I would like to integrate the security portion mentioned at the end ,however, i'm not sure how to integrate it into the download_my_file procedure. I have tried to include a block of code into the procedure so that it runs first but I get errors.
Here is the Procedure code:
create or replace PROCEDURE download_my_file(p_file in number) AS
v_mime VARCHAR2(48);
v_length NUMBER;
v_file_name VARCHAR2(2000);
Lob_loc BLOB;
BEGIN
SELECT MIME_TYPE, BLOB_CONTENT, name,DBMS_LOB.GETLENGTH(blob_content)
INTO v_mime,lob_loc,v_file_name,v_length
FROM file_subjects
WHERE id = p_file;
owa_util.mime_header( nvl(v_mime,'application/octet'), FALSE );
htp.p('Content-length: ' || v_length);
htp.p('Content-Disposition: attachment; filename="'||replace(replace(substr(v_file_name,instr
(v_file_name,'/')+1),chr(10),null),chr(13),null)|| '"');
owa_util.http_header_close;
wpg_docload.download_file( Lob_loc );
end download_my_file;
Here is the "Security" code:
APEX_APPLICATION.G_FLOW_ID := 100;
IF NOT wwv_flow_custom_auth_std.is_session_valid then
htp.p('Unauthorized access - file will not be retrieved.');
RETURN;
END IF;
I have tried to put the security code in a block in front the the "download_my_file" procedure but it did not work for me. I need to know how to integrate the two so that it works. I would greatly appreciate the help.
Thanks
LEH

Answer 1

Hi,
Have you tried something like:
create or replace PROCEDURE download_my_file(p_file in number) AS
v_mime VARCHAR2(48);
v_length NUMBER;
v_file_name VARCHAR2(2000);
Lob_loc BLOB;
BEGIN
APEX_APPLICATION.G_FLOW_ID := 100;
IF wwv_flow_custom_auth_std.is_session_valid then
  SELECT MIME_TYPE, BLOB_CONTENT, name,DBMS_LOB.GETLENGTH(blob_content)
  INTO v_mime,lob_loc,v_file_name,v_length
  FROM file_subjects
  WHERE id = p_file;
  owa_util.mime_header( nvl(v_mime,'application/octet'), FALSE );
  htp.p('Content-length: ' || v_length);
  htp.p('Content-Disposition: attachment; filename="'||replace(replace(substr(v_file_name,instr
  (v_file_name,'/')+1),chr(10),null),chr(13),null)|| '"');
  owa_util.http_header_close;
  wpg_docload.download_file( Lob_loc );
ELSE
  htp.p('Unauthorized access - file will not be retrieved.');
END IF;
end download_my_file;Andy