► How "secure" is your Site Studio site?

NOTE: This only applies to sites hosted directly off of Site Studio; meaning, not published via the Site Studio Publishing Utility (SSPU).

If you don't know how content is secured within Site Studio, expand this:

---

Inherently, Oracle UCM uses two levels of content security:  security groups and, optionally, accounts.  Site Studio sits on top of the content server as the presentation layout for the web sites it hosts, but the content is still secured in the same manner.

A Site Studio page consists of:

1. Fragments
2. Layout Files/Page Templates (.hcsp files)
3. Content (data files, native documents, etc)
4. Assets (images, javascript, etc)

At the minimum, unauthenticated visitors need to have (R)ead access to every piece mentioned above in order to view a Site Studio site unfettered.  This "anonymous user" access is defined by a combination of the Guest role and the account(s) identified by the DefaultAccounts config variable.

---

In my experience, many places have a poorly designed security and metadata model (not to mention an un-normalized one).  As a result, I have seen many implementations give the anonymous user (R)ead access to ALL security groups and the #all account.  In my opinion, there is no chance that 100% of your content is "web ready" and insensitive by nature.  Is it possible?  Sure, but I'm more likely to be the Redskins' quarterback next year, so why expose your web site and content server unnecessarily?

What's my point in all this?

What if I were to say that I could obtain copies of your entire fragment libraries, along with your layout pages, and also know the names and email addresses of those who edited them?

How?

► Custom Property: null vs blank

To determine if a custom property is null (ie. does not exist) vs. blank, use the following code snippet:

---

<!--$executeService("SS_GET_ALL_CUSTOM_NODE_PROP_DEFS")-->
<!--$if rsExists("CustomNodePropDefs")-->
<!--$if isTrue(rsFindRowPrimary("CustomNodePropDefs", "[customPropName]"))-->
     [custom property exists]
<!--$else-->
     [custom property doesn't exist]
<!--$endif-->
<!--$endif-->

---

Note:  It is a misprint in both the 10gR3 and 11g Site Studio Technical Reference Guides when it says the SS_GET_ALL_CUSTOM_NODE_PROP_DEFS service returns a ResultSet named "CustomNodePropertyDefs"; it is actually "CustomNodePropDefs".  In fact, my blog has the only reference to "CustomNodePropDefs" on the internet...seriously. Also, SS_GET_ALL_CUSTOM_NODE_PROP_DEFS requires write access to call it so make sure to handle that accordingly.

Good luck.