Good morning all.
Let me give you some back information about what we currently do as a process and what we plan to do going forward. At the moment we have a department that produces a wide set of documentation for staff in a current APEX system. When a document is requested (for example a simple letter) and then approved the documentation is generated, converted to a PDF then emailed to the staff member as an attachment. This PDF is stored on the file-server/tables in certain instances for auditing purposes. Now the proposal that has been passed forward is to keep this process in place (internally tidy it up) but replace the email to staff with attached document to a system were the staff member logs into a portal and all the documents they have requested (could be one or multiple) are shown with the ability to view any of them in the browser with the above JavaScript libraries.
Now I have done a simple example which in theory works with details below. I have used PDFObject in conjunction with PDF.JS to force the use of that. This is working in the basic form in that I can show a PDF uploaded to the static application files with no issue.
Application: https://apex.oracle.com/pls/apex/f?p=51426
Username: apexpdf
password: apexpdf
workspace name : apexpdf
Now here comes the real test hence this topic and my questions. Looking at the way PDFObject uses this command <script>PDFObject.embed("/pdf/sample-3pp.pdf", "#example1");</script>. I need to pass this a URL of my document. If these documents are stored on the file-server is it a simple case of just generating a URL for the document based off a look up to a document table (for document name) & compare it to the user that's logged into the portal? If this sounds logical any ideas how I go about that? If this is possible how can I protect this method i.e. stop someone seeing the URL in the console and just passing in another random value. Thinking of it do I use something like dbms_cryto for a file-naming system so stop anyone just randomly trying URL strings to see someone else's document. I am absolutely concerned about this being secure as well as functional, as in I don't want anyone to be able to simply grab another users document by changing a parameter in a string for example. Also something to note but I dont think in theory its a problem is that the PDF.js library has to be in the same directory as the PDF's.
I am open to suggestions on how to get a users document to the PDFObject.embed script. Some googling shown me this is mainly used in a .net enviroment.
Any help would be greatly appreciated. Hopefully I have explained my case correctly but if anything does not quite make sense then please ask away.
Regards
K4E
Message was edited by: K4E
Added workspace to show where the files are and how they are called.