Kbase P11988: Difference in permissions in v9 when using dynamic queries
| Autor |
Progress Software Corporation - Progress |
| Acesso |
Público |
| Publicação |
6/21/2006 |
|
Status: Verified
FACT(s) (Environment):
Progress 9.x
SYMPTOM(s):
Difference in permissions in v9 when using dynamic queries
Insufficient permission to write buffer field <fieldname>. (7368)
Insufficient access privilege for table <tablename>. (234)
CAUSE:
Prior to Progress 9.x users could run compiled programs that allowed them access to data which they did not have access to at the data security level, however with the arrival of dynamic queries in Progress 9.x users may not be able to run the compiled programs as before.
FIX:
Before Progress 9.x
User1 has full access to the customer table, user2 cannot read the table. Thus user2 cannot run a procedure that tries to read the customer table. However if user1 compiles a procedure which reads the customer table then user2 can run the compiled program with no error.
This is documented in the System Administration Guide, Page 7-12 (1997) - Compile-time Security.
After Progress 9.x
Again assuming that user1 has full access to customer while user2 can not read the customer table.
The problem now is that user2 could have problems with the following program:
/* query.p */
DEFINE VARIABLE i AS INTEGER NO-UNDO.
DEFINE VARIABLE qh AS HANDLE NO-UNDO.
DEFINE VARIABLE bh AS HANDLE NO-UNDO.
DEFINE VARIABLE fh AS HANDLE NO-UNDO EXTENT 100.
DEFINE VARIABLE tab-name AS CHARACTER NO-UNDO LABEL 'Table name' INITIAL 'Customer'.
UPDATE tab-name.
CREATE BUFFER bh FOR TABLE tab-name.
CREATE QUERY qh.
qh:SET-BUFFERS(bh).
qh:QUERY-PREPARE("FOR EACH " + tab-name).
qh:QUERY-OPEN.
qh:GET-FIRST.
DISPLAY bh:name.
DO WHILE bh:AVAILABLE AND LASTKEY NE KEYCODE("ESC"):
DO i = 1 TO bh:NUM-FIELDS:
ASSIGN fh[i] = bh:BUFFER-FIELD(i).
DISPLAY fh[i]:NAME STRING(fh[i]:BUFFER-VALUE) FORMAT "x(40)".
END.
qh:GET-NEXT.
END.
DELETE WIDGET bh.
This allows the user to select the table they want to view at runtime so even if this file is compiled and user2 then runs the .r file, if they choose the customer table they will get errors:
** Insufficient access privilege for table Customer. (234).