Oracle® Application Express

When configuring the mod_plsql Database Access Descriptor (DAD), you must set the value of the character set portion of PlsqlNLSLanguage to AL32UTF8 regardless of the underlying database character set.

The Database Access Descriptor now contains a parameter for PlsqlRequestValidationFunction. The purpose of this parameter is to limit the number of procedures which can be invoked through mod_plsql. By default, the only procedures permitted are the public entry points of Oracle Application Express. This can be extended using the validation functions shipped with Oracle Application Express. 

Enabling the PlsqlRequestValidationFunction for a Database Access Descriptor may cause existing applications which relied upon publicly executable procedures to fail. You may choose to either omit the PlsqlRequestValidationFunction from the Database Access Descriptor definition, or follow the recommended approach of extending the supplied validation function.

Oracle Application Express release 18.2 uses Font APEX 2.1. This includes many bug fixes and updates. Social or brand icons are not part of Font APEX.

Font APEX 2.1 contains two sets of icons: Small and Large

• Small Icons are 16x16. Large icons are 32x32.

• There are several new directional and form control icons.

• Some templates (cards, media list, and so on) automatically pick up the correct icon size based on template options.

The JavaScript API chapter in the Oracle Application Express API Reference is being migrated to its own new reference guide, Oracle Application Express JavaScript API Reference. This new guide is not finalized and may not include all relevant information.

New widget APIs in this release include:

• grid

• iconList

• interactiveGrid

• menu

• recordView

• tableModelView

• treeView

Namespaces and interfaces:

• apex.actions

• apex.model

A new Side by Side master detail form creates a single page master detail utilizing a side by side layout and report regions with modal edit windows. The left side contains a master list to navigate to the master record. The right side contains the selected master record and up to four detail reports.

Create Page Wizard features a new Dashboard option. Dashboard enables the creation of a first-cut dashboard based on sample data that you can later customize using Page Designer. Choose from a number of different chart layouts as the starting point for your page.

Page Designer now includes a declarative approach to creating static list of values (LOVs).

After installing a sample dataset, clicking Create Application launches the Create Application Wizard and pre-populates it with components built on the sample dataset. Additionally, this release includes new languages for the sample dataset EMP / DEPT.

The application attribute Compatibility Mode controls the compatibility mode of the Application Express runtime engine. Certain runtime behaviors change from release to release. You can use the Compatibility Mode attribute to obtain specific application behavior. This section lists Compatibility Mode changes by release. Note that all mode changes are inclusive in that all changes in older releases are included in newer releases.

Compatibility Mode Changes in Mode 4.1

In Oracle Application Express release 4.1, Automatic DML forms raised an error when rendering the page if the column name of the source of an item was invalid. Prior to Oracle Application Express release 4.1, an invalid column name of the source of an item would not raise an error when rendering the page but it would also not set session state of the item.

Also, in Oracle Application Express release 4.1, there are two new application Security Attributes to control Browser Security: Cache and Embed in Frames. Enabling the Cache attribute enables the browser to save the contents of your application's pages in its cache, both in memory and on disk. The Embed in Frames attribute controls if the browser displays your application's pages within a frame. Applications running in a Pre-4.1 Compatibility Mode function as if the Cache is enabled and as if Embed in Frames is set to allowed. Applications running in Compatibility Mode 4.1 or later respect the specific Browser Security attributes.

Also, in Oracle Application Express release 4.1, because of bug 12990445, the following changes were implemented for Automatic Row Processing (DML) process types. The code which performs the INSERT was changed to determine if the columns should be included in the INSERT statement. Note that these are the same checks which occur before an UPDATE. These new checks include:

• Is the source type a DB Column?

• Is the page item contained in the POST request? For example, if the page item is conditional it will not be contained in the POST request if the condition evaluates to FALSE during page rendering.

• Is the page item not of type Display Only where Save State is set to No?

To enable these behaviors, set the Compatibility Mode to 4.1 or later. For behavior that matches earlier releases, set the Compatibility Mode to Pre-4.1.

Compatibility Mode Changes in Mode 4.2

In Oracle Application Express release 4.2 due to changes for the new grid layout, when a page is rendered, all regions in a certain display point are evaluated before rendering that display point, to find out if they should be displayed or not (so that the grid layout knows how many columns to render). The regions where the evaluation returned true will be executed and displayed. However, this will not work if a PL/SQL based region sets session state which is then used in a subsequent region condition to determine if the region should be displayed. In that scenario, the condition has already been checked before the display point is rendered. Use computations or PL/SQL processes to set session state before any region is displayed. In previous versions, the condition was evaluated right before each region was displayed.

In Oracle Application Express release 4.2, computations and processes with a processing point Before Region(s) do now fire before any region gets rendered. Computations and processes with a processing point After Region(s) fire after all regions have been rendered. In previous versions, the computations and processes fired just before and after the region display point Page Template Body (1-3).

Oracle Application Express Patch Set 4.2.2 added two new Compatibility Mode changes for Compatibility Mode 4.2:

• Text areas were changed to always use the Maximum Width attribute to restrict text input.

• Enhanced security for report column links, where the link contains both JavaScript and references to other report column substitutions, for example:

  javascript:alert( 'Delete #NAME#' );
  

  In the previous example, NAME is a column name in the report.

Prior to Oracle Application Express release 4.2.1, to protect against possible cross-site scripting vulnerabilities, you would have had to explicitly escape any column values in the report source, so that they could safely be used in JavaScript links. When running in Compatibility Mode 4.2, Oracle Application Express automatically JavaScript escapes column name substitutions referenced in JavaScript links if the column is defined to escape special characters.

Compatibility Mode Changes in Mode 5.0

In Oracle Application Express release 5.0, referencing a Static Application File with #WORKSPACE_IMAGES# no longer returns the application file. Instead, use #APP_IMAGES#.

Prior to release 5.0, developers using data upload did not have the option to choose a date format. Instead, a parser checked for the best format to match the user's entry or an end user could enter their own format. Oracle Application Express release 5.0 includes a new item that enables the user to choose an application date format or user entered format. Because applications created before release 5.0 do not have an item, a Compatibility Mode of 5.0 checks if the user has entered some data. If no data has been entered, it picks the application date format.

When a session timeout occurs and no timeout URL is specified, Oracle Application Express raises an error instead of redirecting to the application's home page. If the session setup for an Ajax requests fails, Oracle Application Express also raises an error. For Ajax requests that expect JSON, the response is a JSON string with members that describe the error. For other requests, the error appears on an error page.

Page items based on a database column where the attribute Source Used is set to Only when current value in session state is null will raise an error when the page item gets rendered. Using this setting for a database column is very dangerous and can result in accidentally overwriting data when viewing and saving multiple records. Always set the Source Used attribute to Always, replacing any existing value in session state.

Compatibility Mode Changes in Mode 5.1 / 18.1

In Oracle Application Express 18.1, buttons where the Execute Validations attribute is set to Yes also perform some client-side validations (such as item required checks) and will not submit the page until all issues are fixed. In previous versions this flag was just used to determine if server-side validations should be executed.

In release 5.1, any Ajax-based Dynamic Actions where the "Wait for Result" attribute is set to Yes perform an asynchronous Ajax call. Prior to 5.1, such calls would be made synchronously.

The following example demonstrates how to grant connect privileges to any host for the APEX_180200 database user. This example assumes you connected to the database where Oracle Application Express is installed as SYS specifying the SYSDBA role.

DECLARE
  ACL_PATH  VARCHAR2(4000);
BEGIN
  -- Look for the ACL currently assigned to '*' and give APEX_180200
  -- the "connect" privilege if APEX_180200 does not have the privilege yet.
 
  SELECT ACL INTO ACL_PATH FROM DBA_NETWORK_ACLS
   WHERE HOST = '*' AND LOWER_PORT IS NULL AND UPPER_PORT IS NULL;
 
  IF DBMS_NETWORK_ACL_ADMIN.CHECK_PRIVILEGE(ACL_PATH, 'APEX_180200',
     'connect') IS NULL THEN
      DBMS_NETWORK_ACL_ADMIN.ADD_PRIVILEGE(ACL_PATH,
     'APEX_180200', TRUE, 'connect');
  END IF;
 
EXCEPTION
  -- When no ACL has been assigned to '*'.
  WHEN NO_DATA_FOUND THEN
  DBMS_NETWORK_ACL_ADMIN.CREATE_ACL('power_users.xml',
    'ACL that lets power users to connect to everywhere',
    'APEX_180200', TRUE, 'connect');
  DBMS_NETWORK_ACL_ADMIN.ASSIGN_ACL('power_users.xml','*');
END;
/
COMMIT;

The following example demonstrates how to provide less privileged access to local network resources. This example enables access to servers on the local host only, such as email and report servers.

DECLARE
  ACL_PATH  VARCHAR2(4000);
BEGIN
  -- Look for the ACL currently assigned to 'localhost' and give APEX_180200
  -- the "connect" privilege if APEX_180200 does not have the privilege yet.
  SELECT ACL INTO ACL_PATH FROM DBA_NETWORK_ACLS
   WHERE HOST = 'localhost' AND LOWER_PORT IS NULL AND UPPER_PORT IS NULL;
   
  IF DBMS_NETWORK_ACL_ADMIN.CHECK_PRIVILEGE(ACL_PATH, 'APEX_180200',
     'connect') IS NULL THEN
      DBMS_NETWORK_ACL_ADMIN.ADD_PRIVILEGE(ACL_PATH,
     'APEX_180200', TRUE, 'connect');
  END IF;
  
EXCEPTION
  -- When no ACL has been assigned to 'localhost'.
  WHEN NO_DATA_FOUND THEN
  DBMS_NETWORK_ACL_ADMIN.CREATE_ACL('local-access-users.xml',
    'ACL that lets users to connect to localhost',
    'APEX_180200', TRUE, 'connect');
  DBMS_NETWORK_ACL_ADMIN.ASSIGN_ACL('local-access-users.xml','localhost');
END;
/
COMMIT;

The following example demonstrates how to grant connect privileges to any host for the APEX_180200 database user. This example assumes you connected to the database where Oracle Application Express is installed as SYS specifying the SYSDBA role.

BEGIN
    DBMS_NETWORK_ACL_ADMIN.APPEND_HOST_ACE(
        host => '*',
        ace => xs$ace_type(privilege_list => xs$name_list('connect'),
                           principal_name => 'APEX_180200',
                           principal_type => xs_acl.ptype_db));
END;
/

The following example demonstrates how to provide less privileged access to local network resources. This example enables access to servers on the local host only, such as email and report servers.

BEGIN
    DBMS_NETWORK_ACL_ADMIN.APPEND_HOST_ACE(
        host => 'localhost',
        ace => xs$ace_type(privilege_list => xs$name_list('connect'),
                           principal_name => 'APEX_180200',
                           principal_type => xs_acl.ptype_db));
END;
/

If you receive an ORA-44416: Invalid ACL error after running the previous script, use the following query to identify the invalid ACL:

REM Show the dangling references to dropped users in the ACL that is assigned
REM to '*'.

SELECT ACL, PRINCIPAL
  FROM DBA_NETWORK_ACLS NACL, XDS_ACE ACE
 WHERE HOST = '*' AND LOWER_PORT IS NULL AND UPPER_PORT IS NULL AND
       NACL.ACLID = ACE.ACLID AND
       NOT EXISTS (SELECT NULL FROM ALL_USERS WHERE USERNAME = PRINCIPAL);

Next, run the following code to fix the ACL:

DECLARE
  ACL_ID   RAW(16);
  CNT      NUMBER;
BEGIN
  -- Look for the object ID of the ACL currently assigned to '*'
  SELECT ACLID INTO ACL_ID FROM DBA_NETWORK_ACLS
   WHERE HOST = '*' AND LOWER_PORT IS NULL AND UPPER_PORT IS NULL;

  -- If just some users referenced in the ACL are invalid, remove just those
  -- users in the ACL. Otherwise, drop the ACL completely.
  SELECT COUNT(PRINCIPAL) INTO CNT FROM XDS_ACE
   WHERE ACLID = ACL_ID AND
         EXISTS (SELECT NULL FROM ALL_USERS WHERE USERNAME = PRINCIPAL);

  IF (CNT > 0) THEN

    FOR R IN (SELECT PRINCIPAL FROM XDS_ACE
               WHERE ACLID = ACL_ID AND
                     NOT EXISTS (SELECT NULL FROM ALL_USERS
                                  WHERE USERNAME = PRINCIPAL)) LOOP
      UPDATE XDB.XDB$ACL
         SET OBJECT_VALUE =
               DELETEXML(OBJECT_VALUE,
                         '/ACL/ACE[PRINCIPAL="'||R.PRINCIPAL||'"]')
       WHERE OBJECT_ID = ACL_ID;
    END LOOP;

  ELSE
    DELETE FROM XDB.XDB$ACL WHERE OBJECT_ID = ACL_ID;
  END IF;

END;
/

REM commit the changes.

COMMIT;

Once the ACL has been fixed, you must run the first script in this section to apply the ACL to the APEX_180200 user.

As of this release, the value of THINK_TIME in view APEX_WORKSPACE_ACTIVITY_LOG is always null.

Previously, the computation of this column negatively impacted the view’s performance. It required an additional index, causing more I/O during page processing.

You can compute THINK_TIME by using the following example as a guide:

  select view_date,
         (view_date - lag(view_date) over (
                          partition by apex_session_id
                          order by view_date )) *60*60*24 think_time,
         application_id,
         page_id,
         apex_session_id,
         apex_user
    from apex_workspace_activity_log
   where workspace = 'EXAMPLE WORKSPACE'
     and view_date > sysdate-1
   order by 1, 2 desc

Changes to the engine executing classic reports in order to support REST enabled SQL and REST Services includes the following:

• When Compute Sum is enabled, the application now computes the sum using the SUM() SQL function with a windowing clause.

• When Compute Sum and Break Columns are enabled and the report query contains an ORDER BY clause, the SUM() analytic SQL function may cause the query optimizer to ignore the ORDER BY clause. Use the Sorting > Default Sequence column attribute to control report sorting.

• When Generic Columns and a PL/SQL function returning SQL Query is used, the generated SQL Query must have unique column names (no duplicate column names). Additionally, the column names must be valid SQL identifiers. On Oracle Database 12.2 and higher, column names can be up to 128 characters (for older versions, 30 characters).

• You can only enable Compute Sum for numeric report columns. In previous releases, you could create Classic Reports with Compute Sum enabled for VARCHAR2 columns. These reports now fail with an ORA-1722 error message in this release. Set Compute Sum to No for non-numeric columns in these Classic Reports.

• Oracle Application Express uses Bulk Row Fetching by default for better performance. For tabular forms, however, custom Javascript code may no longer function properly. To force Single Row fetching, add the comment /* APEX$SINGLE_ROW_FETCH*/ to your SQL query.

• In the past, classic reports rendered when the result set contained multiple columns with the same name. In Application Express 18.1, the column names of the query result set must be unique, otherwise a "Column Ambiguously Defined" error occurs. You must change any non-unique report queries present in your current applications.

• Classic reports which select a ROWID column without a column alias may throw ORA-01446 error messages under specific circumstances (cannot select ROWID from, or sample, a view with DISTINCT, GROUP BY, and so on). When a report throws this error message, adjust the SQL query to provide a column alias for the ROWID column.

This release introduces the following changes to the engine executing interactive reports in order to support REST enabled SQL and REST Services:

• Interactive reports with Invalid Computations do not render. Previously, interactive reports could contain invalid computations as long as the computation was hidden by the end user. An invalid computation can occur when end users create computations and developers remove dependent columns afterwards. With this release, such invalid computations display an error message. Since an invalid computation has no value, developers or users should delete them to make the report work again.

• The SQL text generated by an interactive report differs from the text generated in previous versions (however, it is semantically the same). Developers may need to update applications that depend on the exact SQL query text returned by APEX_IR.GET_REPORT

• End users cannot use interactive report columns which are set to "Hidden" in Page Designer in filters, highlights, or other report actions. Setting a column to hidden completely hides this column from the end user.

Property Editor

The following changes have been made to the Property Editor in Page Designer:

• Updated UI to improve usability

• Removed the Show Common, Show All, Collapse All, and Expand All functionality

• Property groups glow when you select a property

• Improved Go to Group functionality

• The Two Pane / Three Pane button has been moved to the Utilities, Layout submenu

Sticky Filters

Filter terms can now be pinned to the Property Editor search filter so you can click other components and retain the filter.

Updates to interactive grid regions in this release include:

• Expose additional events to Dynamic Actions

• A new Selections sub-menu (within the Actions menu) with the following new features:

  • Toggle selection mode between Cell Selection and Row Selection

  • Copy Down, Clear, and Fill actions

  • Copy to Clipboard (for row or cell range selections)

Updates to the tree region for this release include:

• Oracle Application Express now supports the Advanced: JavaScript Initialization Code attribute. This attribute and the Oracle Application Express JavaScript API Reference make customizing the tree region easier (see "Widget: treeView").

• SQL columns and their use no longer have a fixed association. Now you choose the column to use for functions such as node label, tooltip, and link.

• The Hierarchy attribute provides the option to let the engine automatically compute the hierarchy from the SQL statement.

• Added Default Icon attribute. Allow Icon Type to be empty (without forcing a-Icon).

• Improved Page Designer help text for all attributes.

• Support for Dynamic Action Event Selection Change [Tree].

• Advanced Config option (nodeSelector) to support checkbox selection.

• Tree region now supports the apex.region API.

• Copy selection to clipboard.

• For Security reasons, tooltip contents are now escaped.

  To use HTML markup in a tooltip:

  1. Choose "HTML Expression" as Tooltip and use HTML markup in the Tooltip Value attribute.

  2. Reference database columns within Tooltip Value using Substitution syntax (&COLUMN.).

This release introduces the following updates to the Developer Toolbar:

• An indicator for when there is a JavaScript error on the page.

• New Page Info menu which contains the Show Layout Columns and Show Page Timing features.

Updates to the Oracle Application Express Advisor in this release include:

• New Accessibility checks to check your apps for common accessibility issues

• New Performance check for inclusion of compatibility JavaScript

This release introduces the new Text with Autocomplete item type using Oracle JET.

Some additional changes to the implementation of this item type has resulted in the following changed behavior.

Prior to this release, if an Application Express page had only one item on it, and that item was a "Text with autocomplete," pressing the Enter key when focused on the item may have submitted the page. This behavior was not by design in Application Express. Rather, this is a default browser behavior where if a web page contains just one form element, pressing Enter when focused on the item submits the form.

In this release, the updated autocomplete implementation prevents this from happening. If you relied on this behavior in previous releases (such as submitting the page and branching to a page relevant to the selected search item), this no longer works. Implement one of the following solutions instead:

• Add a button next to the autocomplete item that submits the page.

• Use the "update" Dynamic Action event along with a "Submit Page" action to trigger the page submit when a search item is selected.

• Create a Dynamic Action to trigger the submit after the Enter key has been pressed. For example, use the "Key Down" event, define the autocomplete item in the "When > Item(s)", and define a "JavaScript expression" Client-side Condition with the following:

  this.browserEvent.which === 13
  

  Then define a "True Action" that calls the "Submit Page" action type.

This release includes the following improvements in form markup for item types:

• Markup has moved away from tables and changed to <div> elements.

• CSS classes feature a more consistent naming convention.

• Includes additional classes used to style items.

These changes may impact custom themes and therefore could impact your application UI. If you are using a custom theme, you may want to review the markup for items.

If you are using Universal Theme, Oracle recommends refreshing the theme to the latest version to resolve known issues with previous versions of Universal Theme.

Text message substitution updates in this release include:

• For a given text message MY_MESSAGE, you can now use v('APP_TEXT$MY_MESSAGE') to retrieve the message text.

• Use APP_TEXT$MY_MESSAGE$XX to return the translation text for language XX (such as DE, FR, and so on).

• Same syntax is supported on the client via the apex.util.applyTemplate API.

The List View region from the deprecated mobile UI is supported on desktop UI.

This release includes the following updates to the Column Toggle Report region:

• The desktop UI now supports the Column Toggle Report region from the deprecated mobile UI.

• The Column Toggle Report region now supports refresh and page items to submit.

• The Column Toggle Report region now supports the Messages: When No Data Found attribute (desktop only).

• New Column Button Text attribute to customize the button that opens the column popup.

• New accessible table markup and Use As Row Header attribute.

• For the desktop UI, some CSS class names have changed so developers may need to update CSS customizations. Additionally, options related to jQuery Mobile theme are not supported.

This release includes the following updates to the Reflow Report region:

• The desktop UI now supports the Reflow Report region from the deprecated mobile UI.

• The Reflow Report region now supports refresh and page items to submit.

• The Reflow Report region now supports the Messages: When No Data Found attribute (desktop only).

• Accessible table markup and Use As Row Header attribute.

• For the desktop UI, some CSS class names have changed so developers may need to update CSS customizations. Additionally, options related to jQuery Mobile theme are not supported.

The Oracle Application Express server and dynamic_actions_core JavaScript modules no longer call window.onerror when there is an Ajax error.

As of this release, "Classic Report (based on Function)" is no longer available. Use the Classic Report region type instead.

The column SOURCE_TYPE_PLUGIN_NAME of the view APEX_APPLICATION_PAGE_REGIONS now returns NATIVE_SQL_REPORT instead of NATIVE_FNC_REPORT.

Prior to this release, the use of Z automatically applied in the format mask for Datetime information rendered on a JET Gantt chart. However, the use of Z in the format mask for all Datetime information resulted in some unexpected behavior for customers (such as Datetime information on charts rendered with time zone formatting, when no time zone formatting was expected).

In this release, the format mask setting is now based on the data type of the Date columns of a JET Gantt chart (regardless if it is DATE, TIMESTAMP, TIMESTAMP with TIME ZONE, or TIMESTAMP with LOCAL TIME ZONE).

The format mask setting is also based on the data type of the column. For DATE columns, the format mask no longer uses Z. Customers reviewing chart information now see Datetime rendered with the appropriate time zone information.

X-Content-Type-Options - Update your applications and data to send the correct Content-Type. As a workaround, you can set the value to "sniff", but this should only be used in the short term. The "nosniff" value for X-Content-Type-Options prevents MIME-type sniffing in the browser. This can cause regressions if responses return an invalid Content-Type (such as "image/gif" when the file type is PNG).

X-XSS-Protection - prevents some categories of cross-site-scripting attacks.

While you cannot suppress these headers, you can override them by setting different values in the application- or instance-level HTTP Response Headers attributes.

As of this release, the database username and password used to access Database Monitor are now case-sensitive.

In dynamic actions prior to this release, you could use the Set Value action to set multiple affected elements to the same value, not different values. This behavior was limiting and inconsistent with regular page items (you can set multiple page items with different values from the SQL query).

In this release, we have made dynamic actions consistent with page items, so you can now query multiple different values in your SQL Query, and then map those to multiple interactive grid column names.

If you previously defined a SQL Query to query for a single value which set multiple interactive grid columns to that value, you will see a change of behavior where it sets the first interactive grid column only. To fix this, alter your SQL statement so that it selects the same column value, with different column aliases, mapping to each interactive grid column defined in the affected elements.

Example Syntax

Consider the following example:

select 1 col1, 1 col2 from my_table

And in Affected Elements, you would have COL1,COL2 defined for the Columns.

In previous releases, the Master Detail option in the Create Page Wizard appeared under Form. Master Detail is now available as an option in Create Page Wizard.

When you click Master Detail, the following options appear:

• Stacked - Creates single page master detail with editable interactive grids. (In previous releases, this was called Single Page Master Detail.)

• Drill Down - Creates a two page (or Drill Down) master detail. The first page contains an interactive report for the master table. The second page features a standard form for the master and interactive grid for the detail. (In previous releases, this was called Two Page Master Detail.)

• Side by Side - Creates a single page (or Side by Side) master detail with a master table and detail table. The left side contains a master list to navigate to the master record. The right side contains the selected master record and the associated detail report.

  Note:

  Side by Side is new in this release. A Side by Side Master Detail page from the Create Page wizard does not work for applications using a version of Universal Theme created in earlier versions of Application Express because it lacks the required Media List report template. As a workaround, refresh to the latest version of Universal Theme before creating this page.

Additionally, the Create Application Wizard Master Detail options have also been renamed:

• Stacked - Previously called Master Detail.

• Drill Down - Previously called Editable Grid.

Packaged Apps have been renamed to Productivity and Sample Apps.

The Packaged Apps tab has been renamed to App Gallery.

In a new installation or upgrade of Oracle Application Express, you must validate the Oracle REST Data Services installation by running the following:

java -jar ords.war validate [--database <dbname>]

Prior to Oracle Application Express 18.1, jQuery UI based widgets did not support touch for things like drag or slide. We added touch support for all jQuery UI widgets and APEX widgets based on jQuery UI in Application Express 18.1. This allowed drag and slide operations to work with touch devices. For example, the Page Designer splitters could be moved using touch and the Page Designer tree nodes could be dragged and dropped.

This change had the unintended consequence of breaking scrolling with touch in many cases (bug #28076798).

In Application Express 18.2, we reverted this change so that scrolling would work again. In most cases, touch support works the same as before Application Express 18.1.

Rather than add touch support globally for all jQuery UI based widgets, Application Express now supports touch only where scrolling is unaffected. Specifically, touch support is added in the following cases:

• the splitter widget (used in Page Designer and other places)

• interactive grid for column resizing and reordering (note: there are other factors that make it difficult to use interactive grid on small screen mobile devices)

If you relied on the touch support that was added in Application Express 18.1, you can enable it on a per widget basis with code such as the following example:

apex.widget.util.TouchProxy.addTouchListeners( someWidget$[0] );

where someWidget$ is a jQuery object representing the widget element.

In a future release the async option will be ignored and all Ajax requests will be asynchronous.

The function apex.widget.initPageItem is deprecated. Item plug-in creators should use apex.item.create instead.

The jQuery Flot versions 0.7, 0.8, 0.8.2, and 0.8.3 are not used in Oracle Application Express and will be removed in a future release. Packaged Applications have also been updated to remove Flot Line, Flot Bar, and Flot Pie chart plug-ins. Remove any references in your application code and use our declarative chart solution, based on Oracle JET Data Visualizations.

APEX_ERROR.GET_ARIA_ERROR_ATTRIBUTES is deprecated and will no longer be available in the next major release of Oracle Application Express. Developers should replace this functionality with apex_plugin_util.get_element_attributes, which provides better support with native functionality.

The External Processing functionality of Classic Report has been deprecated and will be removed in a future release.

To use the External Processing function in the interim, your application must include the Deprecated or Desupported JavaScript file. To include this file, select the application and edit the User Interface Details. For Include Deprecated or Desupported JavaScript Functions, select Pre 18.x.

Since Oracle Application Express 5.1, APEX_UTIL.STRING_TO_TABLE is deprecated. Use APEX_STRING.STRING_TO_TABLE instead.

Since Oracle Application Express 5.1, APEX_UTIL.TABLE_TO_STRING is deprecated. Use APEX_STRING.TABLE_TO_STRING instead.

The following functions are deprecated as of this release:

• $d_Find

• $d_LOV_from_JSON

• $dom_JoinNodeLists

• $dom_Replace

• $f_Enter

• $f_First_field

• $s_Split

• $tr_RowMoveFollow

• $u_ArrayToString

• $u_js_temp_drop

• $u_SubString

• $x_Check_For_Compound

• $x_object

• $x_Show_Hide

• addLoadEvent

• ajax_Loading

• base_disableItem

• confirmDelete2

• dhtml_ShuttleObject

• doMultiple

• findPosX

• findPosY

• flowSelectAll

• getScrollXY

• hideShow

• html_GetTarget

• html_ReturnToTextSelection

• html_RowDown

• html_RowUp

• html_StringReplace

• htmldb_ch

• htmldb_ch_message

• htmldb_doUpdate

• htmldb_goSubmit

• htmldb_item_change

• ie_RowFixFinish

• ie_RowFixStart

• json_SetItems

• lc_SetChange

• selectString

• setCaretToBegin

• setCaretToEnd

• setCaretToPos

• setSelectionRange

• setValue2

• widget.util.disableIcon

• wiget.util.enableIcon

The JET Dial Gauge chart type is deprecated as of this release, and will be removed in a future release.

The following condition types of the following attributes are no longer supported in Oracle Application Express release 18.1.

For each desupported condition type, follow the proceeding Oracle recommended action to correct your application.

Attribute — Conditions

• For Condition Types:

  • CGI_ENV: DAD_NAME =/!= Value

  • CGI_ENV: HTTP_POST =/!= Value

  • CGI ENV: SERVER_NAME =/!= Value

  Recommended Action:

  • Use a PL/SQL expression, such as SYS.OWA_UTIL.GET_CGI_ENV('XYZ') API instead.

• For Condition Types:

  • Client Browser is Microsoft Internet Explorer 7.0 or higher

  • Client Browser is Mozilla, Netscape 6.x/7x or higher

  • Client Browser is Other browsers (or older version)

  • Client Browser is XHTML / CSS capable browser

  Recommended Action:

  • Use a PL/SQL expression, such as SYS.OWA_UTIL.GET_CGI_ENV('HTTP_USER_AGENT') instead.

  • Use a PL/SQL expression, such as SYS.OWA_UTIL.GET_CGI_ENV('XYZ') API instead.

• For Condition Types:

  • SQL Reports

  • Current Page =/!= Page Submitted (posted)

  • Text =/!= Value

  • Text is/ is NOT contained in Value/Item

  Recommended Action:

  • Use PL/SQL Expression or PL/SQL Function returning Boolean condition types.

• For Condition Type:

  • Always

  Recommended Action:

  • By having no condition specified the same result will be achieved.

Attribute — Read Only Conditions

• For Condition Types:

  • CGI_ENV: DAD_NAME =/!= Value

  • CGI_ENV: HTTP_POST =/!= Value

  • CGI ENV: SERVER_NAME =/!= Value

  Recommended Action:

  • Use a PL/SQL expression, such as SYS.OWA_UTIL.GET_CGI_ENV('XYZ') API instead.

• For Condition Types:

  • Client Browser is Microsoft Internet Explorer 7.0 or higher

  • Client Browser is Mozilla, Netscape 6.x/7x or higher

  • Client Browser is Other browsers (or older version)

  • Client Browser is XHTML / CSS capable browser

  Recommended Action:

  • Use a PL/SQL expression, such as SYS.OWA_UTIL.GET_CGI_ENV('HTTP_USER_AGENT') instead.

  • Use a PL/SQL expression, such as SYS.OWA_UTIL.GET_CGI_ENV('XYZ') API instead.

• For Condition Types:

  • SQL Reports

  • Current Page =/!= Page Submitted (posted)

  • Text =/!= Value

  • Text is/ is NOT contained in Value/Item

  Recommended Action:

  • Use PL/SQL Expression or PL/SQL Function returning Boolean condition types.

Attribute — Server Cache Conditions

• For Condition Types:

  • CGI_ENV: DAD_NAME =/!= Value

  • CGI_ENV: HTTP_POST =/!= Value

  • CGI ENV: SERVER_NAME =/!= Value

  Recommended Action:

  • Use a PL/SQL expression, such as SYS.OWA_UTIL.GET_CGI_ENV('XYZ') API instead.

• For Condition Types:

  • Client Browser is Microsoft Internet Explorer 7.0 or higher

  • Client Browser is Mozilla, Netscape 6.x/7x or higher

  • Client Browser is Other browsers (or older version)

  • Client Browser is XHTML / CSS capable browser

  Recommended Action:

  • Use a PL/SQL expression, such as SYS.OWA_UTIL.GET_CGI_ENV('HTTP_USER_AGENT') instead.

  • Use a PL/SQL expression, such as SYS.OWA_UTIL.GET_CGI_ENV('XYZ') API instead.

• For Condition Types:

  • SQL Reports

  • Current Page =/!= Page Submitted (posted)

  • Text =/!= Value

  • Text is/ is NOT contained in Value/Item

  Recommended Action:

  • Use PL/SQL Expression or PL/SQL Function returning Boolean condition types.

• For Condition Type:

  • Always

  Recommended Action:

  • By having no condition specified the same result will be achieved.

Attribute — Link Conditions

• For Condition Types:

  • CGI_ENV: DAD_NAME =/!= Value

  • CGI_ENV: HTTP_POST =/!= Value

  • CGI ENV: SERVER_NAME =/!= Value

  Recommended Action:

  • Use a PL/SQL expression, such as SYS.OWA_UTIL.GET_CGI_ENV('XYZ') API instead.

• For Condition Types:

  • Client Browser is Microsoft Internet Explorer 7.0 or higher

  • Client Browser is Mozilla, Netscape 6.x/7x or higher

  • Client Browser is Other browsers (or older version)

  • Client Browser is XHTML / CSS capable browser

  Recommended Action:

  • Use a PL/SQL expression, such as SYS.OWA_UTIL.GET_CGI_ENV('HTTP_USER_AGENT') instead.

  • Use a PL/SQL expression, such as SYS.OWA_UTIL.GET_CGI_ENV('XYZ') API instead.

• For Condition Types:

  • SQL Reports

  • Current Page =/!= Page Submitted (posted)

  • Text =/!= Value

  • Text is/ is NOT contained in Value/Item

  Recommended Action:

  • Use PL/SQL Expression or PL/SQL Function returning Boolean condition types.

• For Condition Type:

  • Always

  Recommended Action:

  • By having no condition specified the same result will be achieved.

The jQuery Mobile user interface and Mobile Theme - 51 are desupported. The last stable version of the jQuery Mobile open source library was released on 10/31/2014 and only provides support for jQuery versions 1.8 - 1.11 and 2.1, which no longer receive patches. Oracle Application Express release 18.1 ships with jQuery 3.2. All new application development targeted at mobile devices must be done using the responsive Universal Theme. jQuery Mobile will no longer be supported in future releases.

To learn more about migrating existing applications to the Universal Theme, go to the Universal Theme application at https://apex.oracle.com/ut and select Migration Guide.

The APEXExport program for exporting workspaces, applications, and related files is no longer supported. Use the -split parameter instead without the program.

In a previous release, the AnyChart and AnyGantt flash .swf files were removed from the /images folder. This results in AnyChart map chart and gantt charts no longer rendering. No error message displays, instead the region will be blank.

jQuery 3.1.1 breaks compatibility with earlier 2.x versions. For applications that still rely on removed 2.x functionality, you can use the jQuery Migrate plug-in (to include this plug-in, set the Desktop User Interface Details attribute Include jQuery Migrate to Yes).

If your application relies on removed 1.x jQuery APIs, that functionality no longer works as of Oracle Application Express release 18.1. You must update the JavaScript to only use jQuery 3.1 APIs. See the jQuery migration guides to learn more:

• To migrate from 1.x to 2.x see http://jquery.com/upgrade-guide/1.9/

• To migrate from 2.x to 3.x see https://jquery.com/upgrade-guide/3.0/

jQuery UI 1.12.x has changed the folder structure and files that make up the library compared to version 1.10.4. If you have direct references to any of the old file filenames, you must update them to the new name. For example, if you previously referenced the tabs widget with #JQUERYUI_DIRECTORY#ui/#MIN_DIRECTORY#jquery.ui.tabs#MIN#.js, you must change it to #JQUERYUI_DIRECTORY#ui/widgets/#MIN_DIRECTORY#tabs#MIN#.js.

The Oracle Application Express specific bundle jquery-ui-apex[.min].js that loads by default for Application Express desktop UI pages (either as jquery-ui-apex.js or as part of desktop[_all].min.js) includes all the core files, the drop effect, and the following widgets:

• button

• checkboxradio

• controlgroup

• datepicker

• dialog

• draggable

• droppable

• resizable

• selectable

• sortable

• tooltip

This is essentially the same set as in 1.10.4 with the addition of sortable. If you have a separate reference to sortable, you can remove it.

The jquery-ui-apex[.min].css file loads by default and includes all the jQuery UI CSS files. If you had references to individual jQuery UI css files, you can remove them.

Issue

This issue affects all releases of Oracle REST Data Services except 17.4.1 and 18.2 or later and all releases of Application Express (ORDS services can be created by SQL Developer or an API). This issue exists for services created in the First Apportioned Schema of a workspace when the workspace name and schema name are different.

Due to an error in the way older releases of Oracle REST Data Services retrieve information about the Application Express environment, Oracle REST Data Services cannot serve ORDS Based RESTful Services if a given workspace name does not match the first provisioned schema name. This error was corrected in Oracle REST Data Services 17.4.1 but regressed in Oracle REST Data Services 18.1.

The following examples describe the issue:

• A user has existing APEX Based RESTful Services and migrates them to Oracle REST Data Services, then modifies the ORDS Based RESTful Services definition. If the user calls the services and expects the new logic to perform, instead the older APEX Based RESTful Services are still called. If the user then goes to the APEX Based RESTful Services page, deletes the original service, and runs the service expecting to call the ORDS service, the user instead gets a 404 error.

• If a user creates new ORDS Based RESTful Services in the first provisioned schema but does not have corresponding APEX Based RESTful Services, a 404 error results when the user calls the services.

There is no supported resolution at this time.

Issue

Prior to 5.1, the Application Express RESTful Services interface enabled users to create RESTful service modules with a null URI Prefix (users could also create multiple modules with null URI Prefixes). The URI templates in all modules had to be unique in order to share the null URI Prefix across the services.

Resolution

Logic added to the migration procedure merges all modules that have null URI Prefixes. The rules are as follows:

Oracle REST Data Services 18.2

All affected modules collapse into a single ORDS Based module named merged.apex.rest.services

If any of the APEX Based modules being merged are published, the new merged module publishes.

If none of the APEX Based modules being merged are published, the new merged module does not publish.

All roles associated with APEX Based modules being merged are assigned to the new merged module.

The pagination size of the merged module is set to the largest pagination size in the modules being merged.

For APEX Based modules with null URI Prefixes that also have duplicate URI templates, the following occurs:

• The most recently updated template maintains the duplicate URI.

• All other templates are given the prefix dup001_*

• The comment for the template contains: 1) the original module name that it migrated from, and 2) the original Template URI.

Oracle Application Express 18.1

If you have one module or none with a null URI Prefix, the services migrate successfully regardless of your release of Oracle REST Data Services (the migration is only available in Oracle REST Data Services 17.4.1 or later).

If you have two or more modules with a null URI Prefix, one of the following occurs:

• If you have Oracle REST Data Services 18.2 or later, the modules migrate using the rules above.

• If your Oracle REST Data Services release is older than 18.2, a warning message displays and you cannot migrate your services to Oracle REST Data Services until you upgrade to 18.2 or later.

Issue

This issue affects systems running ORDS 17.4 or prior and Oracle Application Express 18.1 or later.

This issue only affects schemas that are assigned to an Application Express Workspace.

The issue occurs when you use SQL Developer or SQL Scripts (i.e. not the APEX ORDS Workshop) to enable ORDS for a schema, when that schema is also assigned to an Application Express Workspace.

The APEX ORDS Workshop ensures that the ORDS SCHEMA ALIAS and the APEX PATH PREFIX synchronize. However, when ORDS enables a schema using another method, the APEX PATH PREFIX does not sync. When these two items are out of sync, ORDS returns a 404 error when attempting to access ORDS services defined within the schema.

Resolution

To sync the APEX PATH PREFIX with the ORDS URI PREFIX:

1. In Application Express, navigate to the ORDS REST Workshop.

2. Click the Configure button to launch the ORDS Schema Attributes modal dialog.

3. For Schema Alias, select the alias.

4. Click the Save Schema Attributes button.

This sets the same value for both the ORDS SCHEMA ALIAS and the APEX PATH PREFIX.

Issue

Some configurations of required attributes produce inconsistent emissions by screen readers, and may confuse users of assistive technology.

In this case, where a separate validation is used, the item does not contain the required attributes on the item emitted.

This can lead to inconsistencies in what is emitted, and possibly confuse a user of Assistive Technology.

This issue is tracked with Oracle bug 23761182.

Workaround

Instead of using the Value Required item attribute, create simple not null style validations on the items and set the Value Required attributes to no. Then, as long as developers have defined the appropriate label template for required items, this provides a consistent experience across all required items: the required information is conveyed in the label, and not in the item attributes.

Issue

This issue is tracked with Oracle bug 25245829.

Workaround

Use grid view, where links and buttons can be activated.

Issue

In an interactive grid, in grid view, users cannot press the space bar or Enter key to activate buttons or links that are contained in cells when the grid is in Edit Mode.

This issue is tracked with Oracle bug 25245887.

Workaround

Press the ESC key to exit Edit Mode and switch back to Navigation Mode, where the buttons and links can be activated as usual.

Issue

Interactive grid has additional hidden tab stops when users tab past the grid section.

This issue is tracked with Oracle bug 25245934.

Workaround

After tabbing past the grid section, press the Tab key multiple times until you reach the next visibly focusable element on the page.

Issue

Currently in the Property Editor, the display groups are marked up as <div> elements that are focusable with the keyboard. When focused, users can navigate between display groups with the Up and Down arrow keys, which aids keyboard support of the Property Editor. However, when the <div> is focused, JAWS announces the display group title twice, and JAWS does not initially announced the ARIA expanded state when the display group first gets focus (however, it is announced upon expand or collapse).

This issue is tracked with Oracle bug 20693220.

Workaround

Users should be aware that the state is not announced upon first focus, and can either force announcement by pressing Enter and making the group expand or collapse, or alternatively by pressing Tab to go to the next focusable element, which will either be the first field in the group (if expanded), or the next display group (if collapsed).

Issue

Rendering a native check box item renders a FIELDSET tag that acts as a container for the group of check boxes and a LEGEND tag which gives the FIELDSET an accessible title. This works well for check boxes that have more than one check box in the group, but when the check box only has one check box, it is incorrect to render the FIELDSET and LEGEND.

This issue is tracked with Oracle bug 18188460.

Issue

The Maximize functionality built into native region types renders a button within the region allowing the user to maximize the region content to fill the page. If two or more of these regions with maximize functionality enabled appear on the same page, they have duplicate labels for the buttons.

This issue is tracked with Oracle bug 27685217.

There is no supported workaround.

Issue

When running Windows High Contrast mode, many icons and icon buttons are unavailable when using Windows High Contrast mode.

There is no supported workaround.

This issue is tracked with Oracle bug 27781674.

Issue

For this release, the List View of the Calendar region type in 18.2 now uses the native list view of the FullCalendar widget. Prior to 18.2 and prior to FullCalendar supporting this, Application Express had a custom implementation of the list view. The FullCalendar list view uses poorly structure HTML, which negatively affects accessibility.

There is no supported workaround.

This issue is tracked with Oracle bug 27941145.

A previous release introduced the prototype of the Oracle Application Express JavaScript API Reference to the Oracle Help Center. While it has been updated with new content for this release, it is likely some JavaScript APIs were excluded in this version. A more finalized version will accompany a future release.

In the future, this reference will contain all JavaScript APIs. In the interim, please see "JavaScript APIs" in the Oracle Application Express API Reference.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

Event Logging

Application Express provides extensive logging of user triggered events. For example, developers and administrators can use this data to find security and performance issues. The log data includes the user’s IP address and application username plus event specific information. Below is a brief list of event log types.

•   Activity Log - Page views and Ajax requests. Can be disabled by developers and instance administrators.

•   Login Access Log - Successful and failed login attempts.

•   Debug Log - Application-specific instrumentation, such as internal variable values. Disabled by default, the debug log can be enabled by end users and developers.

•   Click Count Log - Clicks on external links within applications.

•   Web Service Activity Log - Requests to external web services from inside the database.

•   Developer Activity Log - Changes to application components.

•   SQL Workshop Log - History of SQL statements in the development environment's SQL Workshop.

Cookies and Related Technologies

Application Express does not use any third-party cookies, but it does use functional cookies (no tracking) and the browser’s SessionStorage and LocalStorage for maintaining the login session and for personalization. This is essential for application security, performance, and ease of use. Below are details about the cookie and storage names that Application Express uses and their intended use.

Session Cookies

• ORA_WWV_USER_instance id - Security cookie for internal applications, like Application Builder.

• ORA_WWV_APP_application id, ORA_WWV_APP_workspace cookie id, custom name - Security cookie for applications. Developers can choose custom cookie names in an application's authentication scheme.

• ORA_WWV_RAC_INSTANCE - Session cookie for the Real Application Cluster (RAC) node instance number, for node pinning on the web server. Only sent when multiple RAC nodes are detected.

Persistent Cookies

• ORA_WWV_REMEMBER_LANG - The user’s selected application language.

• ORA_WWV_REMEMBER_UN - (Optional) Workspace and username of the previous login to the development environment login page. See check box "Remember workspace and username" on the development environment login page for details.

• LOGIN_USERNAME_COOKIE - (Optional) Username of the previous login to developed applications. See check box "Remember username" on login pages of new applications for details. To make this cookie optional on login pages of existing applications, add a "Remember username" checkbox to the page. The API documentation for APEX_AUTHENTICATION.GET_LOGIN_USERNAME_COOKIE and APEX_AUTHENTICATION.SEND_LOGIN_USERNAME_COOKIE has examples for the PL/SQL process code to set the check box value and to only send the cookie when the check box is checked.

Session Storage

• ORA_WWV_apex.builder.devToolbar.grid - This stores the current setting of the Development Toolbar’s Show Layout Columns option.

• ORA_WWV_apex.builder.themeRoller.application id.* - This stores settings of the Development Toolbar’s Theme Roller popup.

• .4000.4500.* - This stores the current tab in each of the tab sets of Page Designer.

• APEX.userHasTouched - This is used to remember if the user has interacted with the application using touch (a touchstart event has been seen). It is used by some components to customize the user experience when using touch devices. 

• .application id.page.*.activeTab - This remembers the last tab selected for Region Display Selector regions or regions using the Tabs Container template that have enabled the option to save the current tab

• ORA_WWV_apex.Calendar.application id.page.region id.lastview - This remembers the last viewed calendar period.

• .application id.page.*.preferenceForExpanded - This remembers the expanded state for collapsible regions.

• ORA_WWV_apex.MED_*.splitterPosition - This stores the splitter bar position for various Interactive Grid settings dialogs.

Local Storage

• ORA_WWV_apex.builder.devToolbar.options - This stores the Developer Toolbar user preference settings: Auto Hide, Show Icons Only, and Display Position.

• ORA_WWV_apex.builder.pageDesigner.useComponentView - This stores the users preference for the Page Designer’s Component View tab.

• ORA_WWV_apex.builder.pageDesigner.model.componentIds - This stores a pool of not yet used IDs for new components in Page Designer.

Check for Updates

When developers log in to the Application Express development environment, they get a notification when a new version is available. To get this version information, Application Express sends a request to an oracle.com server on a bi-weekly basis. It passes anonymized, statistical information about the development server (such as database version and Application Express component usage) that the Application Express product development team uses to make decisions about the products’ future. This check is enabled by default, but can be disabled by instance administrators. To learn more, review the CHECK_FOR_UPDATES parameter in "APEX_INSTANCE_ADMIN" in the Oracle Application Express API Reference.