السلام عليكم ورحمة الله وبركاته

الاسبوع القادمأو البعد قادم علي أقصي تقدير باذن الله سأعمل test Application Server وأصور لكم خطوات الاخفاء كلمة كلمة ان اراد الله تعالي

تحياتي
احمد

والله مشكور جدا يابشمهندس

ربنا يجازيك عنا كل خير على ماتقدمه لنا من إفاده

عسى ما شر اخ mageed_ahmed ونحن با نتظارك

السلام عليكم ورحمة الله وبركاته

الاسبوع القادمأو البعد قادم علي أقصي تقدير باذن الله سأعمل test Application Server وأصور لكم خطوات الاخفاء كلمة كلمة ان اراد الله تعالي

تحياتي
احمد

؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟ 14-6-2010

Sorry for that I had too much effictive CIRCUMSTANCES which did not allow me to have the time for.

Kindly

In Forms 10g we introduced a new feature that is supposed to hide the userid from the request URL in the Developer Suite by generating a HTML form and redirect the request to this form. For some reason this doesn't work well on some XP systems. This doesn't reproduce in the upcoming Developer Suite 10.1.2. Until then, pleae add the followung variable to the Windows regisry (Home of the Developer Suite installation)

HKEY_LOCAL_MACHINE\SOFTWARE\ORACLE\<Developer Suite Home e.g HOME 2>

FORMS90_HIDE_OBR_PARAMS set its value to 0

This will switch off the password hiding feature and allows you to run the Forms from the Developer Suite.

----------------------------------------------------
One way is using
identifier

Example

<identifier confidential="yes" encrypted="yes">fpoiVNFvnlkjRPortn+sneU88=NnN</identifier>

Required/Optional

Optional. You can have a maximum of one identifier element in your server configuration file.

Description

The identifier element is automatically written to the configuration file by the Reports Configuration Assistant when you first install Oracle Reports. The Reports Configuration Assistant sets the values in the form SERVERACCESSKEY/12312312313, where: SERVERACESSKEY is the user name and the random generated number (12312312313) is the password. This user name and password is then encrypted and written to rwserver.template and targets.xml during the time of configuring OracleAS Reports Services. Any Reports Server started after the installation will have this identifier information stored in its configuration file.

For a non-secured Reports Server, the values of the identifier element is used when:

*

Connecting to a Reports Server through the Reports Queue Manager.
*

Shutting down a Reports Server through the command line.

In either of these cases, you must provide the authid in the command line that matches the values specified in the identifier element. To provide a specific password (as the password is a pseudo random number), you must do the following:

1.

Edit the server configuration file, server_name.conf.
2.

Replace the encrypted username/password values generated with custom values.
3.

Set encrypted=no.

Note:
Set confidential=no only if you do not want the username/password to be encrypted.

For example:

<identifier confidential="yes" encrypted="no">username/password</identifier>

4.

Restart Reports Server. Reports Server sets encrypted=yes when it restarts.
5.

Edit the targets.xml file and specify the same username and password values that were included in the server_name.conf file.

You should restart Reports Server, immediately, after making this change. Reports Server automatically encrypts the user name and password and resets encrypted to yes. The values should now read as follows:

<identifier confidential="yes" encrypted="yes">fpoiVNFvnlkjRPortn+sneU88=NnN</identifier>

For a secure Reports Server, the authentication is done by the security infrastructure, that is by using the Oracle Internet Directory repository. Thus, you cannot pass the values in the identifier element to shut down a Reports Server or launch Reports Queue Manager through the console window.

Note:
This user name and password is also used for accessing rwservlet Web commands, such as getjobid, getserverinfo, showjobs, and showenv when DIAGNOSTIC=NO in the rwservlet.properties file. When DIAGNOSTIC=NO, Web commands are disabled for everyone except those administrators who have this user name and password.


--------------------------------------------------------------------

the second way is To hide parameters in your URL requests, you could use a key mapping file entry.

-------------------------------------------------------------------------------------------------
3-if u r using Run_Report_Object() Pl note the attached PDF file+
------------------------------------------------------------------------
4-
Oracle report server requires username and password when report is called using Web.Show_document(). Username and password is required in report calling URL, for example following method calls a reports using Web.Show_Documnet().

Web.Show_Document('http://domainname.com:8090/reports/rwservlet?userid=username/password@db& server=ReportsServer_1&desformat=PDF&destype=cache&report=report.rdf&paramform=yes','_blank');

In above call username and password are visible in URL, causing security problem. Oracle has provieded serveral methods to resolve this problem, one of these solution is to define keymapping in CGICMD.DAT file. In Reports services 11g this file is located at following location

$DOMAIN_HOME/servers/WLS_REPORTS/stage/reports/reports/configuration/cgicmd.dat

In Oracle Reports services 10g this file can be located in \reports\conf directory.

To define a key mapping, append follwing line at the end of the file

userlogin: userid=username/password@db %*

Restart reports server/Managed server, now you can call your report using following URL

Web.Show_Document('http://domainname.com:8090/reports/rwservlet?userlogin&server=ReportsServer_1&desformat=PDF&destype=cache&report=report.rdf&paramform=yes','_blank');

You can define key mapping for as many parameter as you need using following syntax,

userlogin: userid=username/password@db server=ReportsServer_1 desformat=PDF destype=cache %*

Reference: http://download.oracle.com/docs/cd/E12839_01/bi.1111/b32121/pbr_run013.htm
--------------------------------------------------------------------

One Idea
you can add an entry into the CGICMD.dat file on your application server. This can be found in the /reports/conf/cgicmd.dat.
with in this you can add an entery specifying the parameters you want to hide eg.
rhmpdf: server=server destype=cache desformat=pdf userid=user/password@database paraform=no %*
---------------------

There is no real way to hide the URL, but there is a way to avoid the problem of hijacking the report by copying the url.

if the user community is fairly small (100 or so) you can put the url data into a table as a string, attach a sequence number to it when you call the report, then pass the sequence number as the parameter, the before report trigger in the called report can retrieve the data and process it, and the after report trigger in the called report can delete the line passed from the table. (this will avoid the reuse of the url as the command line will be gone (invalid sequence numbers cause the report to abort - exit in the before report trigger).

I have used other approaches (encryption and such) but in the end of the day - the report has to decrypt - which means that if you capture the encrypted url - it will still work. This works passing data from forms to reports as well.
------------
Again Guys accept my apology.
All Ideas are listed and you have to test and do your best
Thank you
Ahmed

frmrepparamform.pdf

السلام عليكم ورحمة الله وبركاته

رائع جدا يابشمهندس

بارك الله فيك وجزاك الله كل خير

شكراً؟؟؟؟؟؟؟؟؟؟؟
ولكن نريد مثال عملي من الاخوة الخبراء او المشرفين لان مو معقول لليوم ما حد ؟؟؟؟؟؟؟؟؟؟؟؟؟

ارجو من الاخوة الذين وضعو بعض الحلول ( النظريييييييييييييية ) ان يتكرمو علينا لو بمثال عملي

اذهب الى الملف cgicmd.dat وتجده فى المسار
dev or app home_path:\report\conf
بنهاية هذا الملف اضف الكود الاتى:-
key: server=your_report_server_name %*
ثم اعد تشغيل application server اذا كنت تعمل على الابلكيشن سيرفر اما اذا كنت تعمل على developer فاعد تشغيل ال oc4j وكذلك اعد تشغيل الreport server service

كل عام وانتم بخير جميعاً

استاذ ماجد ننتظر منك المثال العملي اخفاء server=rep_pc12 بعد اظهار التقرير في صفحة ويب
؟؟

تم تعديل 12 سبتمبر 201015 سنة بواسطة giham

كيف استطيع اخفاء التفاصيل

عن طريق الملف cgicmd.dat