security concerns with "wwv_flow_utilities.gen_popup_list"
TBE2001Aug 28 2007 — edited Nov 24 2008Hi All,<br>
<br>
I would like to raise a question about how APEX is giving information in the html source away.<br>
<br>
When I use certain pop up windows, I find in the html code the SQL query executed - like here:<br>
<br>
function genList0_p_t02_1()<br>
{<br>
w = open("wwv_flow_utilities.gen_popup_list" +<br>
"?p_filter=" + <br>
"&p_name=" + escape('p_t02') +<br>
"&p_element_index=" + escape('1') +<br>
"&p_hidden_elem_name=" + escape('p_t01') +<br>
"&p_form_index=" + escape('0') +<br>
"&p_max_elements=" + escape('') +<br>
"&p_escape_html=" + escape('') +<br>
"&p_ok_to_query=" + escape('YES') +<br>
"&p_flow_id=" + escape('107') +<br>
"&p_page_id=" + escape('13') +<br>
"&p_session_id=" + escape('3000797568689308') +<br>
"&p_eval_value=" + escape('') +<br>
"&p_return_key=YES" +<br>
"&p_translation=" + escape('N') +<br>
"&p_lov=" + filter_escape('<B>SELECT T1.NAME, T1.EMPLID FROM EMPLOYEE_TABLE T1 WHERE T1.EMPL_STATUS = \'A\' ORDER BY 1</B>') +<br>
"&p_lov_checksum=AAD76FA4E830D5731F6D04FCCEBDA65E",<br>
"winLovList",<br>
"Scrollbars=1,resizable=1,width=400,height=450");<br>
<br>
<br>
Its maybe just me, but I don't like that the user can find out what is going on.<br>
<br>
Are there any alternatives ?<br>
<br>
How are others dealing with this issue - if it is even one ?<br>
<br>
<br>
Thanks<br>
Thomas<br>