Bug or Feature - Users able to change data selection via web client

Hi,

Some users at the customer I work with have found a way to change the data selection using the web client. I could not believe it until I saw it myself and replicated the steps. I searched the Oracle site if this was a new feature or a bug but could not find anything in the 8.98 tools net change nor any solution id providing this info.

If someone has any info please let me know. Attached is a document to replicate the steps. The screen dumps are from 8.12 and 8.98.1.1 tools release.


Best Regards,
Joel

This was a feature added in either 8.97 or 8.97, I don't remember which. I think it was 8.97 though. We have disabled those options for the general public from that screen, however.

[ QUOTE ]
Hi,

Some users at the customer I work with have found a way to change the data selection using the web client. I could not believe it until I saw it myself and replicated the steps. I searched the Oracle site if this was a new feature or a bug but could not find anything in the 8.98 tools net change nor any solution id providing this info.

If someone has any info please let me know. Attached is a document to replicate the steps. The screen dumps are from 8.12 and 8.98.1.1 tools release.


Best Regards,
Joel

[/ QUOTE ]

Take a look at this post to see if it is helpful:

http://jeffstevenson.karamazovgroup.com/2009/12/data-selection-security-in.html

Jeff,

Thanks for the link. My scenario is a little different though. I want users to have the ability to change, modify, add data selection. But after they have submitted the job and use the report again, it should show the data selection that was specified in the design.

If you see the document I attached and follow the steps it is possible to permanently change the data selection via the web client unless you build and deploy the package again. If it is a feature then I guess the only way to prevent them from doing this is to prevent them access to the link via row exit

[ QUOTE ]
I want users to have the ability to change, modify, add data selection. But after they have submitted the job and use the report again, it should show the data selection that was specified in the design.

[/ QUOTE ]

Changing the data selection permanently and changing it at runtime are two totally different processes. If your users are running the batch jobs via a menu item you can setup the menu item to prompt for data selection which will show them the same data selection criteria every time that they can change on the fly each time they run it. If they are submitting from the batch versions screen they can select the data selection box after they select the version.

Accessing the Data Selection option from the Row Exit you are referring to was designed to make the development and design of batch versions happen faster without waiting for package builds, etc. The addition of this feature is the reason there are no more "web versions". Typically this feature should be reserved for developers and some super users, but they should be trained on the differences between the two data selection change features.

It is a nice feature, but unfortunately it DOES NOT update the user and date of the data selection change. So if you have more that one user that has access to the Row exit and a data selection change is made that is wrong, there can be a lot of finger pointing because the system does not log the user, date or time. There is an enhancement SAR 8971267 to get Oracle to make this change. So please put your name on this so that some logging can be done.