Weird response on logon

Question

I have gotten a really weird response with a logon. I have a Before Header PL/SQL process on page 1
This is the code
<pre>
SELECT count(*) INTO :GLOBAL_ADMIN
FROM sys.dba_role_privs
WHERE GRANTED_ROLE = 'ADMIN_ROLE'
and grantee = upper(:app_user);
IF :GLOBAL_ADMIN =0 THEN
select div_no,sman_no,cust_no,cust_dept,store_no,region
into :global_div_no,:global_sman_no,:global_cust_no,:global_cust_dept,:global_store_no,:global_region
from nkw.user_restrictions
where user_id = :app_user;
else
:global_cust_no := NULL;
:global_div_no := NULL;
:global_sman_no := NULL;
:global_cust_dept := NULL;
:global_store_no := NULL;
:global_region := NULL;
END IF;
owa_util.redirect_url('f?p=&APP_ID.:6:&APP_SESSION.::NO:RP,6');
</pre>
Basically, this checks if the user is an admin, if they are they don't get globals, if not, the globals are assigned.
The issue was on 1 user, on 1 browser... it was bypassing this code and giving the user full privileges even though he didn't have them.
IE8 on vista on 1 workstation.
I changed the code to cause an error no matter what, and it still bypassed the security. The issue is that this user is bypassing all the security and has access to all customer data, not just his. My customer is very nervous that this will happen again, with other users.
Anyone have any ideas?
I can put the application on apex.oracle.com, but it won't compile due to the fact that I am not putting my entire table structure on there. I can provide access to my local development server if needed.
Thanks a lot. this is kinda urgent, so the quicker the response the better.
-Scott

Answer 1

Hi
Well you could look at setting up VPD, this way the security is controlled by the database - doesn't matter which app they are coming from, they would only be able to access data you gave them access to. The other advantage is that you can't cheat through browser or injection tricks, once you've authenicated as you - the database decides what you get. It also makes writing queries etc alot easier - no more
SELECT *
FROM my_table
WHERE company = :P_COMPANYJust SELECT * because the data will be limited to the users company.
It's also relatively easy to set up and pretty impervious.
I'm sure many people will have a lot of options to suggest here, but that is my opinion.
Cheers
Ben
http://www.munkyben.wordpress.com
Don't forget to mark replies helpful or correct ;)