Skip to main content

APEX ReadOnly Pages - The easy way

If your Oracle APEX Application requires different types of access - full access or readonly - for different types of users, you can specify a Read Only Condition on Page level (or Region, Item, Button, etc.). 
You can set an Authorization Scheme on Application level, so it'll be applied to all pages. So if you have an Authorization Scheme named 'User Can Access Page' defined by a PL/SQL function like this:

return apex_authorization.user_can_access_page
( p_app_id  => :APP_ID
, p_page_id => :APP_PAGE_ID
, p_user    => :APP_USER
); 

then you can code all the logic in the database using the APEX Repository, your own tables or a combination to define whether a user has access to that page or not.
But alas it is not possible to define something similar Application wide for a Read Only condition. You can specify an Authorization Scheme 'User has Read Only Access' using a similar signature as the one above and use that on each and every page in the Read Only Condition using the APEX API:

apex_util.check_authorization( p_security_scheme => 'User has Read Only Access');

that way you still hide the PL/SQL logic. But you have to apply that to every Page ... and that's not very developer friendly. Another downside is that the Page is actually really rendered as readonly: It looks very different to the same page in regular updatable mode. So your layout may be screwed. The advantage is, it is (almost) impossible to hack a page rendered like that to make an illegal update to your database.

So can we achieve a similar / better result with less effort?
Yes, we can. Let's define a Dynamic Action (DA) on Page 0 that'll only run when our previously defined "ReadOnly" Authorization Scheme is met. That DA will run a snippet of JavaScript "On Page Load" :

// Remove Delete, Save, Create buttons and the Popup LOV and Calendar icon
$('a').has('.fa-trash-o, .fa-floppy-o, .fa-plus, img.uPopupLOVIcon').remove();
$('img.ui-datepicker-trigger').remove();
// Switch off input fields within div.uRegionContent 
$('input, select, textarea', 'div.uRegionContent').prop('readonly', true).prop('disabled',true);

So this is removing a number of "update" buttons and set all items to readonly and disabled. Be aware the selectors - especially for the buttons - may be different on your own environment depending on template settings etc.
But although the initial result looks good, as the layout isn't changed and all the items are not updatable, it isn't very secure. The buttons are removed - which is already a tad safer than just disabling them - but I can re-enable all the Page Items with just one line of JavaScript. And also a page submit doesn't require a lot of JavaScript knowledge. So if I can open up my browser console, it is easy to conquer this carefully crafted Read Only Page...
And of course we can add a Condition or Authorization Scheme to every page process to make sure they only run for users with full access, but that would require a lot work again!
So we have to close down the backend as well. And preferably not by adding triggers on every table.... But we can interfere with the PL/SQL that's executed when the page is submitted: There is a section called "Initialization PL/SQL Code" under Security Settings. Although that sounds like it runs only when you "initialise" a page .... it also runs when you initialise a submit!
So if we enter something like this piece of PL/SQL in that section:

if apex_authorization.user_has_read_only_access
   ( p_app_id  => :APP_ID
   , p_page_id => :APP_PAGE_ID
   , p_user    => :APP_USER
   ) and :REQUEST in ('SAVE', 'DELETE', <and a lot more>)
then
  raise_application_error( -20000, 'You are trying to make some changes with Read Only privileges' );
end if; 

a user with Read Only access who tries to fire an illegal SAVE or DELETE request, will be blocked (although that message isn't shown). If you look in the (standard) DML Processes you can see there are quite a lot of requests that should be in that list. Be aware that other - especially unconditional request - are not protected by this!

But with just one snippet of JavaScript and one piece of PL/SQL we implemented a Read Only feature on each and every page of our application - and the pages still look exactly the same!

Post a Comment

Popular posts from this blog

Dockerize your APEX development environment

Nowadays Docker is everywhere. It is one of the main components of Continuous Integration / Continuous Development environments. That alone indicates Docker has to be seen more as a Software Delivery Platform than as a replacement of a virtual machine.

However ...

If you are running an Oracle database using Docker on your local machine to develop some APEX application, you will probably not move that container is a whole to test and production environments. Because in that case you would not only deliver a new APEX application to the production environment - which is a good thing - but also overwrite the data in production with the data from your development environment. And that won't make your users very excited.
So in this set up you will be using Docker as a replacement of a Virtual Machine and not as a Delivery Platform.
And that's exactly the way Martin is using it as he described in this recent blog post. It is an ideal way to get up and running with an Oracle database …

Refresh selected row(s) in an Interactive Grid

In my previous post I blogged about pushing changed rows from the dabatase into an Interactive Grid. The use case I'll cover right here is probably more common - and therefore more useful!

Until we had the IG, we showed the data in a report (Interactive or Classic). Changes to the data where made by popping up a form page, making changes, saving and refreshing the report upon closing the dialog. Or by clicking an icon / button / link in your report that makes some changes to the data (like changing a status) and ... refresh the report.  That all works fine, but the downsides are: The whole dataset is returned from the server to the client - again and again. And if your pagination size is large, that does lead to more and more network traffic, more interpretation by the browser and more waiting time for the end user.The "current record" might be out of focus after the refresh, especially by larger pagination sizes, as the first rows will be shown. Or (even worse) while you…

Using multiple Authentication Schemes for your APEX application

Recently someone asked me how he could implement multiple authentication schemes for his APEX application. He would like to use (some kind of) Single Sign-on authentication and - as an alternative - an Application Express Authentication. The problem is ... you can only define one Authentication Scheme being "Current" for an application! So how can we solve this issue?

First, we need te be aware that multiple applications can share their authentication by using the same cookie. Thus if you specify "MYCOOKIE" as the Cookie Name in Application A as well as in Application B, you can switch from A to B and back without the need of logging in again. It doesn't matter what Authentication Scheme Type you are using!

Knowing this, we are halfway our solution. We need two Applications. One - the "real" application - using the Application Express Authentication, let's name this one "LAUNCHPAD". And another one using the Single Sign-on Authentication…