PLEASE REPORT: on testing of Server once again!

[Ruslan Zasukhin]

on 5/1/03 6:07 AM, Keith DeLong at delong at redcort.com wrote:

>>>      res = mDataBase.Create(dbname, 1, 32 * 1024 )
>>>      //or
>>>      res = mDataBase.open( dbname )
>>> 
>>> 
>>>      mDataBase2 = new MyDataBase2(server)
>> 
>> And here can be problem.
>> 
>> Look. Some User with some password can have right to access DatabaseA on
>> server. But this DO NOT means that he must be able access all other
>> databases on this server.
> 
> I didn't understand this. The master.vdb didn't seem to allow for this. The
> master.vdb only has user table (name and password) and databases (name and
> path) table. 

Image some Internet probider.

It have ONE server, which handle 10 dbs from different organizations.

User Keith of organization A say:

            db = new Vdatabase( "ip", "Keith", "passw", "OrgA_db ");

So far so good.

But now Keith have find from his friend that name of organsition B db is
orgB_secretDB. So he do:

            db = new Vdatabase( "ip", "Keith", "passw", "OrgB_secretDB");

And get access to NOT his db.

Right now VServer allow this scenario, and in nearest alphas we going
prohibit this.



-- 
Best regards,
Ruslan Zasukhin      [ I feel the need...the need for speed ]
-------------------------------------------------------------
e-mail: ruslan at paradigmasoft.com
web: http://www.paradigmasoft.com

To subscribe to the Valentina mail list go to:
http://listserv.macserve.net/mailman/listinfo/valentina
-------------------------------------------------------------