Oracle® HTML DB

Release Notes

Release 2.0

B16374-02

September 2005

These Release Notes contain important information not included in the Oracle HTML DB documentation. For the most current information, refer to updates of this document, which are located at the following Web site:

http://www.oracle.com/technology/documentation/

This document contains these topics:

- Important Configuration Changes

- Configuring Oracle HTTP Server in a New Installation

- New Features

- Open Bugs and Known Issues

- Documentation Corrections and Additions

- Documentation Accessibility

Important Configuration Changes

For Oracle HTML DB 2.0, the value of the character set in the configuration of the mod_plsql Database Access Descriptor (DAD) must be set to AL32UTF8, regardless of the underlying database character set.

In Oracle HTTP Server 10g Release 1 or Oracle Application Server 10g, the file ORACLE_BASE/ORACLE_HOME/Apache/modplsql/conf/marvel.conf contains the information about the DAD to access Oracle HTML DB. The line containing PlsqlNLSLanguage determines the language setting of the DAD. The character set portion of the PlsqlNLSLanguage value must always be set to AL32UTF8, regardless of whether or not the database character set is AL32UTF8.

In Oracle HTTP Server Release 9.0.3, the file ORACLE_BASE/ORACLE_HOME/Apache/modplsql/cfg/wdbsvr.app contains the information about the DAD to access Oracle HTML DB. The line containing nls_lang determines the language setting of the Database Access Descriptor. The character set portion of the nls_lang value must always be set to AL32UTF8, regardless of whether or not the database character set is AL32UTF8.

In addition to these DAD configuration changes, you must apply the included patch for the PL/SQL Web Toolkit to every database where you wish to run Oracle HTML DB 2.0. Please review the README.txt file contained in the directory htmldb/patch/bug4554072 for instructions about applying this patch.

Configuring Oracle HTTP Server in a New Installation

Oracle HTML DB must have access to Oracle HTTP Server with mod_plsql. Perform the following post-installation steps if:

- You are running Oracle HTTP Server 10g release 1 or release 2 or Oracle Application Server 10g.

- Oracle HTTP Server is installed in an Oracle home.

- You have not previously configured Oracle HTTP Server to work with Oracle HTML DB.

These instructions do not apply if you are running Oracle HTTP Server release 9.0.3. For more information on configuring Oracle HTTP Server release 9.0.3, see the Oracle HTML DB Installation Guide.

Create a marvel.conf File

If you have not previously configured Oracle HTTP Server to work with Oracle HTML DB, you need to create a marvel.conf file.

To create the marvel.conf file:

1. Use a text editor and create a file named marvel.conf.

- For UNIX and Linux based systems, save to:

ORACLE_BASE/ORACLE_HOME/Apache/modplsql/conf

- For Windows based systems, save to:

ORACLE_BASE\ORACLE_HOME\Apache\modplsql\conf\

2. Copy the following into the marvel.conf file. Replace ORACLE_HOME, host, port, service_name, and htmldb_public_user_password with values appropriate for your environment.
The following example assumes you specified the image directory alias as /i/ when you installed HTML DB. Note that the path listed is only an example. The path in your marvel.conf file should reference the images directory alias for your environment.

Alias /i/ "ORACLE_BASE/ORACLE_HOME/htmldb/images/"
AddType text/xml       xbl
AddType text/x-component       htc

<Location /pls/htmldb>
Order deny,allow
PlsqlDocumentPath docs
AllowOverride None
PlsqlDocumentProcedure      wwv_flow_file_manager.process_download
PlsqlDatabaseConnectString  host:port:service_name ServiceNameFormat
PlsqlNLSLanguage            AMERICAN_AMERICA.AL32UTF8
PlsqlAuthenticationMode     Basic
SetHandler                  pls_handler
PlsqlDocumentTablename      wwv_flow_file_objects$
PlsqlDatabaseUsername       HTMLDB_PUBLIC_USER
PlsqlDefaultPage            htmldb
PlsqlDatabasePassword       htmldb_public_user_password
Allow from all
</Location>

3. Save and exit the marvel.conf file.

Edit the httpd.conf File

Next, you need to edit the httpd.conf file to reference the marvel.conf configuration file.

To edit the httpd.conf file:

1. Use a text editor and open the httpd.conf file.

- For UNIX and Linux based systems:

ORACLE_BASE/ORACLE_HOME/Apache/Apache/conf/httpd.conf

- For Windows based systems:

ORACLE_BASE\ORACLE_HOME\Apache\Apache\conf\httpd.conf

2. Add an entry to reference the marvel.conf configuration file.

include "ORACLE_BASE/ORACLE_HOME/Apache/modplsql/conf/marvel.conf"

3. Save and exit the httpd.conf file.

Stop and Restart Oracle HTTP Server

To stop and restart Oracle HTTP Server:

- For UNIX and Linux based systems, execute the following commands:

ORACLE_BASE/ORACLE_HOME/opmn/bin/opmnctl stopproc ias-component=HTTP_Server
ORACLE_BASE/ORACLE_HOME/opmn/bin/opmnctl startproc ias-component=HTTP_Server

- For Windows based system, execute the following commands:

ORACLE_BASE\ORACLE_HOME\opmn\bin\opmnctl stopproc ias-component=HTTP_Server
ORACLE_BASE\ORACLE_HOME\opmn\bin\opmnctl startproc ias-component=HTTP_Server

New Features

This section describes new features of Oracle HTML DB that are not documented elsewhere.

This section contains the following topics:

- SQL Injection Analysis Reports

- Session IDs Required in f?p URLs

SQL Injection Analysis Reports

A SQL Injection analysis report is available in Oracle HTML DB 2.0, in the SQL Workshop Utilities. This feature enables you to compile PL/SQL functions, procedures and packages for analysis of SQL Injection vulnerabilities. Potential SQL Injection vulnerabilities can then be reviewed in the accompanying reports.

This feature is only available with Oracle Database 10g release 2 (10.2) or later. Additionally, this feature requires the installation of additional PL/SQL packages (DBMS_GLOBAL_DATAFLOW and DBMS_SQL_INJECTION_ANALYZER) which are not distributed with Database 10g release 2 (10.2.0.1). These required packages may be distributed by Oracle at a later date.

Session IDs Required in f?p URLs

In earlier releases of Oracle HTML DB, when a previously authenticated user attempted to use a link to an application that did not contain a session ID, the HTML DB engine would check if the user's browser had a session cookie that located a valid session for the link. If the HTML DB engine found a session cookie and located a valid session, the user could access the application using that session. Similarly, if an authenticated user attempted to use a link to the application and the link session ID did not match the current session, the user would still be allowed to access the page because of the presence of the session cookie for the currently authenticated session.

In Oracle HTML DB 2.0, page requests do not contain a session ID. If a session ID does not match the current session, the user will have to be repeat the authentication process, after which a new session will be assigned. Because of this change, you may notice changes in the way bookmarked links work. For example, the use of bookmarked links to pages that require authentication may result in the user being required to repeat the authentication process to the application.

As a best practice, developers should take special care to construct internal links between application pages so that they always contain the current session ID, using &APP_SESSION., v('APP_SESSION'), :APP_SESSION, or equivalent methods appropriate for the context in which the links are constructed.

Open Bugs and Known Issues

This section describes bugs and known issues for Oracle HTML DB:

- Supported Web Browsers

- Importing Spreadsheet Data Containing Quotation Marks

- Column Attribute Format in Japanese

- Creating an Item with a Japanese Item Name

- Runtime Errors in an Application Imported from a Previous Release

- Creating a Web Reference on a WSDL that Has Input Parameters Defined as Arrays

- No Support for Corel SVG Viewer

- Enabling Triggers from within Object Browser

- Downloading Triggers with Multibyte Names

- Granting Specific Privileges on Materialized Views and Packages

- Creating Triggers Using Existing Names in Object Browser

- Exporting a SQL Script Always Includes the First Script File

- Generate DDL Utility Corrupts Some Multibyte Table and Columns Names

- Unsupported Commands in SQL Command Processor

- Sorting Mixed Case Columns in a Query in Object Browser

- Disabling Constraints Having Mixed Case or Lower Case Names

- No Support in Object Browser to Create an 'UPDATE OF' Trigger for Tables Having Lower or Mixed Case Names

Supported Web Browsers

To view or develop Oracle HTML DB applications, Web browsers must support JavaScript and the HTML 4.0 and CSS 1.0 standards. The following browsers meet this requirement:

- Microsoft Internet Explorer 6.0 or higher (Windows only)

- Netscape Communicator 7.2 or higher

- Mozilla 1.2 or higher

- Firefox 1.0 or higher

Importing Spreadsheet Data Containing Quotation Marks

If you import spreadsheet data by copying and pasting and a column value contains a double quotation mark, the data will not import correctly (for example, 54" Plasma Flat Screen). To avoid this problem, you have two options:

- Option 1:

a. Save the data in a delimited format (such as comma-delimited (.csv) or tab-delimited).

b. Use Import Text Data wizard to upload and import the saved file.

- Option 2:

a. Replace the quotation mark with two double quotation marks as shown in the following example:

54"" Plasma Flat Screen

b. Use the Import Spreadsheet Data wizard to import the file.

Column Attribute Format in Japanese

When you open the number or date format select popup dialog on the Column Attribute of a Page Definition in Application Builder, it always displays 'backslash'+ 5,234.10 in the dialog. It is expected that the symbol of 'yen' displays accurately in a Japanese environment.

Note that backslash and yen are the same character code point, but display differently depending on the selected font. Backslash is also displayed when applying the data format on the page in the application.

This issue is tracked with Oracle bug 3384664.

Creating an Item with a Japanese Item Name

If you create a form on a table or view based on an included column whose name is in Japanese using a wizard, the name of the new item will be included in Japanese.

This issue is tracked with Oracle bug 3393090.

Workaround:

To correct this problem, when you create new items on the Page Definition use alphanumeric characters A_Z, 0-9 and '_' for the item names. You may also need to changes item names to alphanumeric before you apply changes to the item.

Runtime Errors in an Application Imported from a Previous Release

If you export an application from an earlier Oracle HTML DB release and then import and install it using the installation pages in Application Builder, in rare situations you may encounter runtime errors after the application installs.

These errors often manifest themselves as PL/SQL parser or execution errors pertaining to blocks of PL/SQL code embedded within application components. The installation process sometimes splits strings greater than 200 characters into multiple lines. For example, lines may split between PL/SQL keywords, or at other places that cause parsing errors.

This issue is tracked with Oracle bug 3854874.

Workaround:

If you encounter these types of errors and suspect the installation process has split large strings:

1. Isolate the failing component containing the suspect PL/SQL within the application by editing the failing page in Application Builder.

2. Locate the blocks of code that appear to split incorrectly.

3. Attempt to split the blocks of code in more appropriate places, or insert white space with the lines until no runtime errors are observed.

4. Export the application, import the export file, and then reinstall it.

5. Retain the new export file as a permanent backup copy.

Creating a Web Reference on a WSDL that Has Input Parameters Defined as Arrays

If you create a Web service reference in Oracle HTML DB on a WSDL document that has input parameters defined as arrays, you will not be able to use built-in wizards to create a form or a form and report on that Web reference.

This issue is tracked with Oracle bug 3922270.

Workaround:

Oracle HTML DB does not provide a user interface for input parameters that are arrays. Output parameters that are defined as arrays are handled properly if you use the Form and Report on Web Service Wizard.

No Support for Corel SVG Viewer

Oracle HTML DB release 2.0 does not support the Corel SVG Viewer.

Enabling Triggers from within Object Browser

You cannot enable triggers from within Object Browser.

This issue is tracked with Oracle bug 4563602.

Workaround:

Use SQL Command Processor and enable triggers using standard Oracle syntax. For example:

ALTER TRIGGER trigger_name ENABLE

Downloading Triggers with Multibyte Names

If you download a trigger with a multibyte name from the Object Details view in Object Browser, the file name becomes corrupt.

This issue is tracked with Oracle bug 4581512.

Workaround:

Download triggers with multibyte names from the Code view.

Granting Specific Privileges on Materialized Views and Packages

You cannot grant specific privileges on materialized views and packages in Object Browser.

This issue is tracked with Oracle bug 4578016.

Workaround:

Grant a specific privilege on a Materialized view or package using standard Oracle syntax. For example:

GRANT SELECT ON materialized_view TO user

Creating Triggers Using Existing Names in Object Browser

You cannot create a trigger in Object Browser if the name already exists even if it contains different capitalization (for example, TRIGGER1 and trigger1).

This issue is tracked with Oracle bug 4578658.

Workaround:

Use SQL Command Processor to create a trigger using standard Oracle syntax. For example:

CREATE TRIGGER "trigger1" BEFORE INSERT ON ...

Exporting a SQL Script Always Includes the First Script File

Exporting SQL scripts using the Add to Export button always includes the first script regardless of whether it is currently selected.

This issue is tracked with Oracle bug 4583602.

Workaround:

To address this issue:

1. Select all scripts and click Add to Export.

2. Then, select those you do not wish to export and click Remove Checked.

Generate DDL Utility Corrupts Some Multibyte Table and Columns Names

In some character sets, multibyte table and columns names are corrupted when generating DDL.

This issue is tracked with Oracle bug 4579524.

Workaround:

Use the SQL view in Object Browser to create the DDL for any object that is corrupted by the Generate DDL utility.

Unsupported Commands in SQL Command Processor

SQL Command Processor does not support the SQL commands EXPLAIN PLAN and LOCK TABLE.

This issue is tracked with Oracle bug 4552205.

Workaround:

Use SQL*Plus or another SQL client to perform these actions.

Sorting Mixed Case Columns in a Query in Object Browser

The Query function in Object Browser does not currently support sorting of lower case or mixed case column names. If you are using the Query function in Object Browser, your table has mixed case or lower case column names, and you select a column to be used as an order by, the select fails.

This issue is tracked with Oracle bug 4601878.

Workaround:

Use the Query Builder to create and run your query.

Disabling Constraints Having Mixed Case or Lower Case Names

If you select a table in Object Browser, select the Constraints tab, and then attempt to disable a constraint whose name contains lower or mixed case letters, the disable will fail.

This issue is tracked with Oracle bug 4601636.

Workaround:

Use SQL Command Processor to disable or enable using standard Oracle syntax. For example:

ALTER CONSTRAINT "Constraint_Abc" DISABLE

No Support in Object Browser to Create an 'UPDATE OF' Trigger for Tables Having Lower or Mixed Case Names

Object Browser does not support the creation of "UPDATE OF" triggers for tables having lower or mixed case names. To create a trigger in Object Browser, you can either:

- Select a table, select the Triggers tab, and then click Create.

- Click Create in the upper right of Object Browser and select Trigger.

If you set Options to update of, you will be prompted to select a column but the columns for lower or mixed case table names will not display.

This issue is tracked with Oracle bug 4601883.

Workaround:

Use SQL Command Processor to create the trigger using standard Oracle syntax. For example:

CREATE TRIGGER "Mixed_Case_Trigger"
BEFORE
UPDATE OF "Mixed_Column" ON "Mixed_Case_Table"
FOR EACH ROW
BEGIN
...

Documentation Corrections and Additions

This section lists additions and corrections to Oracle HTML DB documentation.

Oracle HTML DB Installation Guide Additions and Corrections

This section lists corrections in the Oracle HTML DB Installation Guide.

- The procedure described in "Configuring Oracle HTTP Server in a New Installation" was not included in the production version of the Oracle HTML DB Installation Guide.

- In section 2.5, "Oracle Text Requirement" the example that explains how to run the language preferences script for US English, drdefus.sql should read as follows:

c:\> sqlplus ctxsys/CTXSYS_password
SQL> @c:\oracle\product\10.2.0\db_1\ctx\admin\defaults\drdefus.sql

Oracle HTML DB User's Guide Corrections

This section lists corrections in the Oracle HTML DB User's Guide.

- In "What's New in Oracle HTML DB?" the following text is incorrect:

"Use Object Browser to browse, create, and edit objects in multiple schemas in a single database. Object Browser includes a new PL/SQL editor. You can use this editor to edit and compile packages, procedures, functions, and triggers while taking advantage of syntax highlighting and error reporting."

Syntax highlighting is not a feature of the PL/SQL editor in Object Browser.

- The section "About Transactions in the SQL Command Processor" explains that the user can specify the maximum amount of time a transactional command in the SQL Command Processor waits before timing out by configuring the system preference, SQL_COMMAND_MAX_INACTIVITY. This preference has been renamed SQL Commands Maximum Inactivity in minutes.

Documentation Accessibility

Our goal is to make Oracle products, services, and supporting documentation accessible, with good usability, to the disabled community. To that end, our documentation includes features that make information available to users of assistive technology. This documentation is available in HTML format, and contains markup to facilitate access by the disabled community. Accessibility standards will continue to evolve over time, and Oracle is actively engaged with other market-leading technology vendors to address technical obstacles so that our documentation can be accessible to all of our customers. For more information, visit the Oracle Accessibility Program Web site at http://www.oracle.com/accessibility/.

Accessibility of Code Examples in Documentation

Screen readers may not always correctly read the code examples in this document. The conventions for writing code require that closing braces should appear on an otherwise empty line; however, some screen readers may not always read a line of text that consists solely of a bracket or brace.

Accessibility of Links to External Web Sites in Documentation

This documentation may contain links to Web sites of other companies or organizations that Oracle does not own or control. Oracle neither evaluates nor makes any representations regarding the accessibility of these Web sites.

TTY Access to Oracle Support Services

Oracle provides dedicated Text Telephone (TTY) access to Oracle Support Services within the United States of America 24 hours a day, seven days a week. For TTY support, call 800.446.2398.

Oracle HTML DB Release Notes, Release 2.0

B16374-02

Copyright © 2004, 2005, Oracle. All rights reserved.

The Programs (which include both the software and documentation) contain proprietary information; they are provided under a license agreement containing restrictions on use and disclosure and are also protected by copyright, patent, and other intellectual and industrial property laws. Reverse engineering, disassembly, or decompilation of the Programs, except to the extent required to obtain interoperability with other independently created software or as specified by law, is prohibited.

The information contained in this document is subject to change without notice. If you find any problems in the documentation, please report them to us in writing. This document is not warranted to be error-free. Except as may be expressly permitted in your license agreement for these Programs, no part of these Programs may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose.

If the Programs are delivered to the United States Government or anyone licensing or using the Programs on behalf of the United States Government, the following notice is applicable:

U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the Programs, including documentation and technical data, shall be subject to the licensing restrictions set forth in the applicable Oracle license agreement, and, to the extent applicable, the additional rights set forth in FAR 52.227-19, Commercial Computer Software—Restricted Rights (June 1987). Oracle Corporation, 500 Oracle Parkway, Redwood City, CA 94065

The Programs are not intended for use in any nuclear, aviation, mass transit, medical, or other inherently dangerous applications. It shall be the licensee's responsibility to take all appropriate fail-safe, backup, redundancy and other measures to ensure the safe use of such applications if the Programs are used for such purposes, and we disclaim liability for any damages caused by such use of the Programs.

Oracle, JD Edwards, PeopleSoft, and Retek are registered trademarks of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.

The Programs may provide links to Web sites and access to content, products, and services from third parties. Oracle is not responsible for the availability of, or any content provided on, third-party Web sites. You bear all risks associated with the use of such content. If you choose to purchase any products or services from a third party, the relationship is directly between you and the third party. Oracle is not responsible for: (a) the quality of third-party products or services; or (b) fulfilling any of the terms of the agreement with the third party, including delivery of products or services and warranty obligations related to purchased products or services. Oracle is not responsible for any loss or damage of any sort that you may incur from dealing with any third party.

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2014, Oracle and/or its affiliates. All rights reserved.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Alpha and Beta Draft Documentation Notice

If this document is in preproduction status:

This documentation is in preproduction status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.