Xss in a Region-Title like &Name.

Hi,
I have sort of a general question.
I have tried to manipulate a Region-Title like &Name. with a
JavaScirpt Statemante. When I paste the code
<script>alert('Hello world');</script>
directly in the Title-Field of the Region, it works.
But when I try to fill it from a text-field, it does not work.
So when I paste
<script>alert('Hello world');</script>
in a text-field named Text, and the Region-Title is &Text.,
it does not work.
The characters are escaped, but I don't know, why.
Does anyone knows, how I can make this work ?
ciao, Andre

Hello Andre,
>> The characters are escaped, but I don't know, why.
The APEX engine is automatically escaping the page fields, as part of its rendering process. This is to prevent XSS, which is a serious security breach.
>> Does anyone knows, how I can make this work ?
Well, as you are talking about a region title, you can still use the *&ITEM.* notation, just populate it in using an On Load – Before Header process.
Regards,
Arie.
&diams; Please remember to mark appropriate posts as correct/helpful. For the long run, it will benefit us all.
&diams; Author of Oracle Application Express 3.2 – The Essentials and More

Similar Messages

Item substitution in region title

It looks to me like the help docs say that you can substitute for a region title like this -- &user.
When I do that all I get is &user printed on my report.
Am I doing this wrong?
Using version 1.3.6
Curt

Does this substitution syntax hold true when exporting the region to CSV? The CSV filename is automatically set as the parent region's title and but I need to include the date int that filename. I've created a hidden page item to hold my title, but when I use the &(ITEMNAME). syntax in the region title I just get &ITEMNAME. Any idea what I'm doing wrong, or how to achieve the desire effect by another method?

OBIEE - edit report entities like title, column name, decimal places

Hi all,
How do I edit OBIEE report entities like title, column name, decimal places?
I know I can edit column name in repository, but I hope I can do it also at report level.
As you can see, year looks like "2012.00", I don't need these zeros after "2012", how do I edit it?

Using Criteria tab
Column Properties->Data Format->Override Default Data Format
You may go for Save button to make it catalog level for that column
Edited by: Srini VEERAVALLI on Dec 7, 2012 10:57 AM

How to escape special characters in a region title

I have created a drill down report where the second report is filtered by a value chosen in the first report. I am using &Pn_field. syntax to pass the name of the select value to the region title of the second report. Some of the returned values have a ':' in them and therefore the text does not print after the ':'. How do I escape the ':' in the region title?
regards
Paul P

Paul,
I think your question is "How do I use f?p URL syntax to pass data values to a page where the data includes a colon?" (Please correct me if that's not the issue.) The answer is, you can't. Same with commas. HTML DB reserves those two characters for the f?p request syntax. You'll have to save the string into the item before the page branch. There is no restriction on what characters can be used in a region title, it's just HTML-formatted text, except that you must escape anything that looks like HTML unless you want the browser to treat it as HTML. There are restrictions, however, on what characters you can pass in URLs in general and you must take care to escape them properly, e.g., ?, &, whitespace.
And do speak up if I've missed the point.
Scott

Expand the Background Image to Cover the Entire Region Title

I have a region title that contains an image and it has a height of 2 rows but the background image (blue image) is not expanding in the area (the css contains repeat for the background). The application uses theme 2. Can someone help?
CSS:
.rc-title {
    background: url("../images/bg-region-blue-l.gif") repeat scroll 0 0 transparent;
    float: left;
    width: 100%;
div.rc-blue-top
    background: url("../images/bg-region-blue-l.gif") repeat scroll 0 0 transparent;
    float: left;
    width: 100%;
}I created the application on APEX.ORACLE.COM:
Workspace: RGWORK
User: TESTER
Password: test123
Application : CSRSR (33558)
Select Signage from the menu (only choice).
You will see that one of the tabular forms has Nameplates and an image, another tablular form has an image but no text (Nameplates) even though it is there. I would live the blue to cover both the image and the text.
Please help
DB: 10g
APEX 4.1
APEX 4.2 (APEX.ORACLE.COM) works the same way.
Robert
http://apexjscss.blogspot.com

sect55 wrote:
fac586 ,
I would like to try the second option:
>
Another option would be to eliminate the problem by moving the nameplate images out of the region titles. There's horizontal space within the regions that will allow these images to be positioned to the left of the tabular forms, which would look OK.
But how do I reference the horizontal space within the regions? I looked at the template for the region:
<div class="rounded-corner-region float-left-100pct" id="#REGION_STATIC_ID#" #REGION_ATTRIBUTES#>
<div class="rc-blue-top"><div class="rc-blue-top-r">
<div class="rc-title">#TITLE#</div>
<div class="rc-buttons">#CLOSE##PREVIOUS##NEXT##DELETE##EDIT##CHANGE##CREATE##CREATE2##EXPAND##COPY##HELP#</div>
</div></div>
<div class="rc-body"><div class="rc-body-r"><div class="rc-content-main">#BODY#<br />
</div></div></div>
<div class="rc-bottom"><div class="rc-bottom-r"></div></div>
</div>and couldn't find out to put the image in the horizontal space.
Can you please help me by providing the details? There are two options, depending on the role you see the nameplate images playing on the page. I've used the two regions to provide one example of each.
*1. Nameplate as eye-candy:* If there's sufficient information in the region title, region content and item labels to make the nameplate images superfluous in providing information to the user, and you're just using them to improve the appearance of the page, then they can be applied purely using CSS.
/* Nameplate image as CSS eye-candy */
#nameplates-ndc div[id$="catch"] {
min-height: 36px;
padding-left: 113px;
background: transparent url(#WORKSPACE_IMAGES#nameplate_ndc.gif) top left no-repeat;
background-size: 103px;
}Note the use of the CSS3 <tt>background-size</tt> property to resize the image. If the app has to run in browsers that don't support this then you'll have to drop it and create an image of the exact size required for use in the <tt>background</tt> rule.
*2. Nameplate as content:* If the nameplate images are necessary to provide information to the user, then they have to be included in the region (and they must have an <tt>alt</tt> attribute providing an alternative representation of the information contained in the image).
Put the image in the region Header:
<img src="#APP_IMAGES#nameplate_n.gif" width="103" alt="Nameplate (name only)" />and float it so it sits alongside the form:
/* Nameplate image as page content */
#nameplates-name .rc-content-main img {
float: left;
margin-right: 10px;
}

Custom Region Title

I've read through numerous posts on how to use &MY_ITEM. in a region title to make it dynamic. I'm sure this is what I need but I have a little different situation and since I'm new to HTMLDB, I hope someone can assist.
I have 2 regions on the page in a parent/detail relationship. The 2nd region has a query that joins 2 tables one of which returns a column that is not updated by anything on the page, it is just PRODUCT_DESC (a product description). The product ID comes from the first region via a Select list with redirect item. The report region then dynamically runs its query and returns the needed information. What I would like to see is the PRODUCT_DESC put into the Region title so I don't have it listed as a separate column in the report output.
I've tried creating a hidden item and setting its value to the product_desc db column but that is not working. I imagine I may need some computation or process but those are still kind of foreign to me so I'm looking for some assistance.
Thanks,
Brian

Thanks for your time Scott
The code is as follows:
DECLARE
v_SelectStmnt VARCHAR2(2000);
v_app_offline VARCHAR2(1);
v_app_offline_message VARCHAR2(100);
BEGIN
v_SelectStmnt := 'SELECT NAME';
v_SelectStmnt := v_SelectStmnt||' , OCCUPATION';
v_SelectStmnt := v_SelectStmnt||' FROM TBL_EMPLOYEES';
wwv_flow.debug(v_SelectStmnt);
RETURN v_SelectStmnt;
EXCEPTION
WHEN OTHERS THEN
SELECT APP_OFFLINE
, APP_OFFLINE_MESSAGE
INTO v_app_offline
, v_app_offline_message
FROM DATA_SOURCE_TBL
WHERE DATA_SOURCE = 'HR DATABASE';
IF v_app_offline = 'N' THEN
:P1_ERROR := TO_CHAR (SQLCODE)||': '||SQLERRM;
ELSE
:P1_ERROR := v_app_offline_message;
END IF;
v_SelectStmnt := 'SELECT NULL AS NAME';
v_SelectStmnt := v_SelectStmnt||' , NULL AS OCCUPATION';
v_SelectStmnt := v_SelectStmnt||' FROM DUAL';
wwv_flow.debug(v_SelectStmnt);
RETURN v_SelectStmnt;
END;
Regards
Jim

How to change a region title based upon the input parameter?

Hi All,
I need to change the region's title dynamically based on the value of a select list in another region.
Can anyone help me in this?
Regards,
Sakthi.

Hi,
You can use &P1_ITEM_NAME. (including the & and the .) in a region title - this string will be replaced by the value from the page item called P1_ITEM_NAME, so change the name to suit your page item
Andy

ITunes 8.1 Cover Flow - Won't Display Full Album Titles/Artist Names

I don't understand why Apple would change Cover Flow to display less characters than before, but many, many artists/albums aren't showing complete titles, with an elipse marking where it gives up. There doesn't seem to be a universal character limit either, as, bizarrely, a few short titles like 'Come On Pilgrim' aren't showing either.
Does anybody else suffer from this problem? Is it fixable? If not, I think I'll be rolling back.

Just to add, when the album is selected on my ATV, all track names are shown so they're obviously in the system. It's only when they start playing that most of the time I just get 'Track 4' etc.

Is there anyway to import my file title like img_001 into my file info so it will show up in my meta data. I have 300 images and I was wonder if I could batch process them...

Is there anyway to import my file title like img_001 into my file info so it will show up in my metadata?

you can re-number files as you import
you may need to a test of a few un-important files
click the re-name file panel >>tick>>template>>click on arrows>>edit and that will take you the customize panel
add image name like "img"
then add numbering I have only used the first one (import)
make sure you add two "00" so they stay in order
should look like img-001
bugga of a number tool imo; bridge is easier/better
you could also rename in windows or bridge or other programs before importing BUT ONLY IF THE FILES HAVE NOT BEEN IN LR ALREADY. Sorry to yell thats important as you most likely know
Yell if that doesn't make sense

Region Title substitution string

hi, i am trying to use &TITLE. in a region header as was expecting to see the title of the region shown ? it does not (apex 3.2)
however the template for the region has this and it works fine..
can someone help ?
thanks
a

Thanks.
This is what I am trying to do.
I have a (whole) bunch of Anychart 5 charts in a page in different regions with their own title and there are many pages like this.
I have the region titles inside the chart too.
as in
<pre>
Region Title
| Region Title |
| |
| |
| | <----- This is the chart
| |
| |
|___________________________________|
</pre>
The XML for all these charts are the same, except for the title.
So I created an application level item and moved the XML without the title tag into it and just refer the item in the custom XML.
This way I make changes in one XML block.
(title is useful when some one wants to save the chart as an image) (Note: #DATA# is part of the XML, the value I push into this item)
If I can get a handle on the region title, I could push that in the XML as a variable (and not code to generate the XML in)
At this point (except for saving the chart as an image) I can get by with the titles being at the region level
and not inside the chart. But we are planning to move all of the charts into a dashboard and we might need the
titles inside or on top of the individual charts. ( I am also researching if the titles could go on the
hbox tags in Anychart XML, so this might not be necessary and also have come across some javascript in the past that copies the data elements
available inside a report, like total, to an item, that might work too.)
Hope that sheds some light on what I am trying to do.
Thanks
A

APEX 4.1.1, Region title as a link to an application page

Hello,
I have a page with a lot of regions where I'd like the Region Title be a link to a different page in the application so when the user clicks the Title they get redirected to that page.
I have seen a number of variables like APP_ID etc but I can't seem to figure out how to use them in this case.
Any good ideas on how to do this?
Regards,
Andy

You should be able to create a display only page item, P1_ITEM then populate that item with your link, then in the region title enter &P1_ITEM.
Include the dot.
I assume the region is setup to display the title.
PS - Create a hidden region that this page item will reside in so it doesn't display elsewhere on page.
Edited by: Bob37 on Mar 8, 2012 1:29 PM

Dynamic Region Title

Hello,
I'm attempting to create a generic survey like application that can have a number of possible questions and instructions. I would also like for the region title of certain regions to be dynamic, or rather equaling the value of some item on the page. I did some digging on Google and found that this was apparently possible in Apex 3, but I'm currently working in Apex 4. Does anyone know of a way to do this?
Thanks

Deep_in_Texas wrote:
When does the following code executes on your page?
while P4_POSITION - is SQL query with source select e.POSITION_NAME from POSITION e where e.POSITION_ID = :P4_POSITION_ID
Thanks
Pradeep
(I changed my handle but it's still displaying the number !!!!)
Edited by: 965010 on Oct 12, 2012 7:31 AMI don't know when it is executed. I've just created page item P4_POSITION and made it as SQL query.
Actually, value in the P4_POSITION_ID item is from POSITION_ID in EMPLOYEE table, which contains primary key EMPLOYEE_ID and has foreign key - POSITION_ID,
POSITION_ID is a primary key of POSITION table, which contains POSITION_NAME.
What I made is I created link from page 3 using EMPLOYEE_ID to redirect to page 4. There are all items in the page 4, which are in the EMPLOYEE table. But I need to show POSITION_NAME from POSITION table. So I created page item P4_POSITION as I mentioned before.
Do I need to create dinamic action or process before handling Region title?

Computed Region TItles being Escaped in Apex 2.2

In Apex 2.0, HTML contained within a hidden item to be display in a Region's Title was not escaped. <BR>In Apex 2.2, the same information is now escaped and my computed Region titles are displaying HTML text, instead of the HTML.
I would like to be able to generate region titles instead of them just being fixed text.
Is there anything I can do here? It would be great if there was a way to unescape the Title.<BR>
Furthermore:<BR>
If I put the HTML directly into the Region Title, it displays fine. So the question is .... why does the info get escaped if it is in an item for display? You can imagine how long the region title will become if a few anchors are presented in the title.
Message was edited by:
sgreber

Doug:
I agree, I think the help text is, in fact, stating the opposite of the observed behaviour.
Quoting When session state is referenced in this way, the value emitted to the page will have special characters (<, >, &, ") escaped if the referenced item has one of the following safe item display types:
But what we see is that if the referenced item is of type "Hidden", special characters *are* escaped. If the item is a "safe item", then, by definition, it cannot be tampered with, so there is no need to escape it on output!
What worries me is that such a major change was introduced in a minor patch release like 2.2 where even the export/import API version has not changed i.e. it is otherwise compatible in all aspects. I am sure this is going to cause Production applications at many customer sites to break because they rely on HTML markup in &ITEM. variables being rendered unchanged.
Thanks

Missing titles / file names

Until recently photos imported into iPhoto took as their title the name of the file eg IMG_0611.JPG. Now the titles are blank, is this something that can be controlled in the importing process?
Thanks for any help.

Do the filenames look as usual in the Finder?
Try this basic fix trash the com.apple.iPhoto.plist file from the HD/Users/ Your Name / library / preferences folder. (Remember you'll need to reset your User options afterwards. These include minor settings like the window colour and so on. Note: If you've moved your library you'll need to point iPhoto at it again.)
*What's the plist file?*
For new users: Every application on your Mac has an accompanying plist file. It records certain User choices. For instance, in your favourite Word Processor it remembers your choice of Default Font, on your Web Browser is remembers things like your choice of Home Page. It even recalls what windows you had open last if your app allows you to pick up from where you left off last. The iPhoto plist file remembers things like the location of the Library, your choice of background colour, whether you are running a Referenced or Managed Library, what preferences you have for autosplitting events and so on. Trashing the plist file forces the app to generate a new one on the next launch, and this restores things to the Factory Defaults. Hence, if you've changed any of these things you'll need to reset them. If you haven't, then no bother. Trashing the plist file is Mac troubleshooting 101.

Display records returned for a query in the Report Region Title

Hi,
Is there any variable set that can be referenced to indicate how many records have been returned for a specific query. I have several hide/show regions dealing with various reports, and I would like to add a little info into the region title to display how many records there were returned for the report in this region.
Thx in Advance,
cliff

Hi,
addendum
These are simple sql queries BTW. I've seen posts alluding to the SQL%ROWCOUNT when using cursors. Is there any variable we can reference when using a simple sql query?
thx
cliff

Xss in a Region-Title like &Name.

Similar Messages

Maybe you are looking for