SQL keyword used as filename Error

[smallredville]

Hi All,

Recently my colleagues used a file name of SQL keywords such as "insert.odt", "update.odt".

When the JAVA batch program did the processing (JAR file of LAPI 9.7 was used), it gave the following errors:

+++ Start of session errors +++
Status Code: 106603
Api Error:
Error Message:
Status Message: There is illegal string "insert" in the query string
+++ End of session errors +++

Does the above error means, those SQL keyword like insert, update should not be used as document's name?

Hope someone who encountered similar issue before can share with me on this post or maybe anyone who has any feedback. =)

Thank You in advance,
smallredville

 

[ggriffit]

I can confirm that on 971 you can add these files via the browser, I'll leave those more experienced with LAPI to comment on the LAPI front.

The keywords don't appear in the Naming Conventions document (

https://knowledge.opentext.com/know...al_Characters.pdf?nodeid=13698124&vernum=-2).

I do recall there was an issue with a security patch to stop Cross Site Scripting which blocked allsorts of characters and keywords, this may be the issue.

Greg Griffiths
Livelink Certified Developer & ECM Global Star Champion 2005 & 2006

http://www.greggriffiths.org/livelink/

 

[appnair]

106603 does not appear in my version of les971.could it be a wrapper api that somebody wrote in your place.Is the actionfailing on createobjecex and createversion for you or somewhere else

Well, if I called the wrong number, why did you answer the phone?
James Thurber, New Yorker cartoon caption, June 5, 1937
Certified OT Developer,Livelink ECM Champion 2008

http://www.tek-tips.com/faqs.cfm?fid=2884

http://www.linkedin.com/in/appunair

 

[smallredville]

Hi Appnair and ggriffit,

Thanks for the reply.

To be more specific the errors

+++ Start of session errors +++
Status Code: 106603
Api Error:
Error Message:
Status Message: There is illegal string "insert" in the query string
+++ End of session errors +++

occurs when I called the ListObjects with objectName to include keyword such as "delete data.odt" or "insert data.odt" etc.

Below is my ListObjects section:

if ((status = doc.ListObjects(filetoVolumeID, fileto, null, "NAME = '" + objectName + "'", 0, results)) != 0)
{
LivelinkHandler.writeSessionErrors(GlobalVariables.session);
return false;

}//end if


Any feedbacks are greatly appreciated.

Thank you very much =)
smallredville

 

[appnair]

your livelink server is running this patch called

https://knowledge.opentext.com/knowledge/llisapi.dll/properties/15371009

called pat08100.txt I can see that error is set after you do that

queryBlackList = GetPrefList( sysPref, 'Lapi', 'ListNodesQueryBlackList', {'commit',';','drop','alter','update','insert','delete','create', 'set'} )
					
					retStatus = CheckAgainstList( .fInArgs.QueryStr, queryBlackList, FALSE )
					
					if ( !retStatus.OK )
					
						ok = FALSE
						._SetError( 106603, retStatus.errMsg )
					end

Hope that helps or let us know if you want to know how to get around it

Well, if I called the wrong number, why did you answer the phone?
James Thurber, New Yorker cartoon caption, June 5, 1937
Certified OT Developer,Livelink ECM Champion 2008

http://www.tek-tips.com/faqs.cfm?fid=2884

http://www.linkedin.com/in/appunair

 

[smallredville]

Hi Appnair,

Thanks for the reply.

Really appreciate that =)

May I know how to get around with it?

many thanks in advance =)
smallredville

 

[ggriffit]

The code is managed by :

queryBlackList = GetPrefList( sysPref, 'Lapi', 'ListNodesQueryBlackList', {'commit',';','drop','alter','update','insert','delete','create', 'set'} )

either remove the values from the opentext.ini file :

[LAPI]
ListNodesQueryBlackList = {xxx}

if present or you can remove it from the default part of the queryBlackList line above to be safe.

Bear in mind that this will open up a potential security hole, so it may be worth checking with OT about this as there is a write up on the issue at

https://knowledge.opentext.com/knowledge/livelink.exe?func=ll&objId=15433696&objAction=ArticleView

Greg Griffiths
Livelink Certified Developer & ECM Global Star Champion 2005 & 2006

http://www.greggriffiths.org/livelink/

 

[smallredville]

Thanks Greg and Appnair =)

Appreciate your feedbacks very much =)

smallredville