Whose files do I see in wwv_flow_files.

Question

Hi,
I wish to download and run a piece of vbscript in the users environment. The vbscript does a mail merge with word, dowloading the mail recipients through a URL that I provide.
Using the upload/download tutorial I have created my own procedure to download a file which I have uploaded.
The procedure goes like this:
create or replace procedure run_vbscript
as
v_length number;
v_file_content blob;
v_blob blob;
v_clob clob;
v_errmsg varchar2(100);
begin
begin
select blob_content
into v_file_content
from wwv_flow_files
where filename = 'labels.vbs';
exception
when others then
v_errmsg:= substr(sqlerrm(-sqlcode),1,100);
DBMS_LOB.CREATETEMPORARY(v_file_content, true, DBMS_LOB.SESSION);
dbms_lob.writeAppend(v_file_content, length(v_errmsg), utl_raw.cast_to_raw(v_errmsg));
end;
-- set up http header
-- use an nvl around the mime type and
-- if it is a null set it to application/octect
-- application/octect may launch a download window from windows
owa_util.mime_header('text/vbscript', false);
-- set the size so the browser knows how much to download
v_clob := to_clob('Dim sServer' || chr(10) || ' sServer = "http://<link to xml generating page>"');
v_blob := wwv_flow_utilities.clob_to_blob(v_clob);
dbms_lob.append(v_blob, v_file_content);
v_length := dbms_lob.getlength(v_blob);
htp.p('content-length: ' || v_length);
-- the filename will be used by the browser if the users does a save as
htp.p('content-disposition: attachment; filename="labels.vbs"');
-- close the headers
owa_util.http_header_close;
-- download the blob
wpg_docload.download_file(v_blob);
end run_vbscript;
grant execute on run_vbscript to public
The tricky thing is that when I run this procedure in the SQL Workshop, I get the contents of my uploaded file. When I invoke it from a URL where the URL is #OWNER#.run_vbscript, the procedure executes but the file contents is replaced by the error message "No data found".
Replacing "where filename = 'labels.vbs'" with "where rownum < 2" will provide me with a file from a completely different user.
What is the reason, and what is the best solution?
Thanks in advance,
Torben

Answer 1

Torben - The wwv_flow_files view shows you documents in the documents table (defined in the DAD) that are associated with the workspace to which you a currently authenticated. This is the workspace you logged into for SQL Workshop, or the workspace associated with the APEX application that is running your query against the view. If you run the procedure through the URL directly, you are not authenticated so you don't see any rows (except a few orphaned documents).
If you upload files and transfer them to your own table, then you could download from your table, implementing whatever security measures you deem appropriate.
Scott