Hiding username and password in HTML report???

[camilo]

I'm building a reports page for the companys intranet, where using Oracle 7.3, ColdFusion and Crystal Reports 7. But everytime I try to access the page to a certain report it ask me for the user and password. Using a Form in html I could pass these values to the server using <br>&lt;input type=&quot;hidden&quot; name=&quot;user0&quot; value=&quot;username&quot;&gt;<br>and the same for the password. But if a user on the client side views the source for the html, they can see the user name and password for the database. My question is does anyone know how I can prevent the user from seeing these values, can I hide them or is there a way to prevent them from seeing the source.<br><br>Thanks for your time.

 

[GIC]

This may be a stupid idea but maybe you can pass them via javascript or vbscript (response.write) and hide the code.

 

[WBaeck]

Hi,<br><br>I have the same concern. I did separate my reports into several categories. One that is public, one each for users with a special access permission to the web site. I then put the reports into directories that are protected and only users who had the right for that portion of the web site can get to the reports.<br>This puts me in the position to then use as user Id and password a low security user-id and password that can be seen by the person looking at the source since they wouldn't have gotten the source to begin with if they didn't have the right to go to this category. <br>I hate this workaround since it is still open and only marginally better than what you do.

 

[DaveHowe]

I have a similar problem.
As a trial solution, I considered that if I called the activex control, refreshed the data then used the export ability to generate a one-off report (either cr for the viewer or PDF) I *should* be able to give the user the report, up to date and in a choice of formats, but with no raw access at all to the database (stored data only)
Anyhow - here is my current (trial) code.

Dim CR_Object, CR_Engine, CR_Report
' some globals
cr80FileFormat=2048
crEDTDiskFile=1
crEFTCrystalReport=1
crEFTPortableDocFormat=31
Set CR_Engine=CreateObject("CrystalRuntime.Application")
Set CR_Report = CR_Engine.OpenReport("c:\cr_test\test.rpt", 1)
CR_Report.Database.LogOnServer "PDSODBC.DLL", "SQL_SVR", "", "Scott", "Tiger"
' not real username of course ;)
CR_Report.ReadRecords
CR_Report.SaveAs "c:\cr_test\cr_out.rpt", cr80FileFormat
CR_Report.ExportOptions.DestinationType = crEDTDiskFile
CR_Report.ExportOptions.FormatType = crEFTCrystalReport
CR_Report.ExportOptions.DiskFileName = "c:\cr_test\cr_export.rpt"
CR_Report.Export(False) 
CR_Report.ExportOptions.PDFExportAllPages = True
CR_Report.ExportOptions.FormatType = crEFTPortableDocFormat
CR_Report.ExportOptions.DiskFileName = "c:\cr_test\cr_export.pdf"
CR_Report.Export False
Set CR_Report = Nothing
Set CR_Engine = Nothing

 

[DaveHowe]

Hmmm - (semi) update here; apparently there are some heavy licencing implications involved in implimenting this thread's ideas - see the thread marked &quot;Export reports to HTML? You may owe $10K per year&quot;
(

http://www.tek-tips.com/gviewthread.cfm/lev2/4/lev3/100/pid/149/qid/64619)