Re: systools. group_ptf_currency Secuirty Concern Responses

On 21-Oct-2015 18:31 -0500, Krill, Coy wrote:

Charles Wilt on Wednesday, October 21, 2015 12:58 wrote:

--snipped--

On 20-Oct-2015 14:04 -0500, Krill, Coy wrote:

I had our network folks open the firewall so that our
Production, Test and DR machines could access
[http://www-912.ibm.com/s_dir/sline003.nsf/PSPbyNumL.xml?OpenView&count=500]
and have the systools.group_ptf_currency view work properly.

<<SNIP>>

A couple thoughts
- you can access that doc via https if you wish.
- looks like the GETHTTP<xxx> functions (used by
group_ptf_currency()) support the use of a proxy

Look at page 22 (pdf 25) of this doc
[https://www-304.ibm.com/partnerworld/wps/servlet/download/DownloadServlet?id=k4ixw2TAAIwiPCA$cnt&attachmentName=accessing_web_services_using_ibm_db2_for_i_udfs_and_udtfs.pdf&token=MTQ0NTQ1NzMzNzA0MA==&locale=en_ALL_ZZ]

It does work over https to load the page, however, IBM didn't create
the view with an https:// URL, it's an http:// URL. I suppose we
could recreate the view, however, I'm not enamored with the idea of
changing base system tools. I'll see what the concern is tomorrow.

So perhaps rather than re-create the existing VIEW with the redaction [because that revision might be replaced\lost by the application of maintenance or lost per any /recovery/ processing for that tooling, or even, albeit doubtful, could cause installation problems due to having replaced a system-supplied object with a user-created object], just issue a CREATE VIEW MyLibr.MyView AS ... request, whereby the new VIEW_DEFINITION is an effective copy of the existing VIEW from SYSTOOLS, but with the modification from the 'http' specification to the 'https' specification.

I have no access to the VIEW source\definition, but seems from what is quoted above, notably "we could recreate the view", that is all that should be necessary, apart from, when seeking the information that the SYSTOOLS.GROUP_PTF_CURRENCY IBM-supplied VIEW provides, refer [in the table-reference of a query] instead to the privately created version of that VIEW.?

Not that I am aware of any, but there could be restrictions on the ability to create the VIEW with reference to the same objects referenced in the system-supplied VIEW; notably, there is an effective "system_file" flag that could be required, to allow access to certain functions, and that capability would be available only to system-programming-interfaces. In that case, asking IBM for a means to effect the alternative form of invocation via the VIEW [or an alternate VIEW] might be the only hope. Seems from what Charles wrote however, that the VIEW probably is implemented using only /publicly/ supported features of the database rather than using any functions restricted to the use only by the OS\database itself.