HomeForum
Welcome, Guest

DatabaseBrowser: Updating Views though not granted
(1 viewing) (1) Guest
  • Page:
  • 1

TOPIC: DatabaseBrowser: Updating Views though not granted

DatabaseBrowser: Updating Views though not granted 4 years ago #520

  • roland
  • OFFLINE
  • Fresh Boarder
  • Posts: 4
  • Karma: 0
Dear Support!

First of all, congratulations and thanks for the marvelous tool, we're using it intensively for quick data overviews and sql statement creation!

There is one drawback and that is a rather severe one. I discovered that the table data is changeable in the data grid on views, even though there is no update/inser/delete granted on the view (the normal \"update set...\" fails)

It seems that database browser somehow bypasses normal security with my connection. The database I'm using, is MS SQL Server 2000, I run version 2.4.2 of database browser (using \"MS SQLServer\" as connection type, but the same behaviour is also observed with connection type \"ODBC\").

The issue is (i hope) easily reproducible when creating a view like \"select * from \" ,having full modification rights on and select only rights on the created view.

There is a feature in MS Query that allows to enable/disable modifications within MS Queries data grid, the interesting thing here is that MSQuery observes the missing update permissions, when trying to change data!

The whole problem seems only to occur when using Windows builtin security (trusted accounts), I've created a separate user now (SQLServer security), where updating isn't possible.

Any help/hints on how to circumconvent that problem are highly appreciated!

-kind regards,
Roland

Re:DatabaseBrowser: Updating Views though not gran 4 years ago #521

  • mike8888
  • OFFLINE
  • Expert Boarder
  • Posts: 131
  • Karma: 0
Thanks for your feedback.
We will check it ang get back you.

Mike

Re:DatabaseBrowser: Updating Views though not gran 4 years ago #524

  • admin
  • OFFLINE
  • Moderator
  • Posts: 2183
  • Karma: 12
I had quick look at the problem you reported.
I do not think it Has something to do with our software.
We do not bypass MS Sql server security or connect to it via back door if it ever existed.
We use ADO to connect to the database.
If ADO allows to update the record there is nothing for us do or to fix

John

Re:DatabaseBrowser: Updating Views though not gran 4 years ago #526

  • roland
  • OFFLINE
  • Fresh Boarder
  • Posts: 4
  • Karma: 0
Hi John!

I'm sorry, but I use ADO myself and just tested whether I could update a View using ADO. The server/driver correctly returns the \"Update permission denied on object ...\" message that I also get when using MSSQL Server builtin security.

Just out of curiosity: Do you use client side cursors or server side ones?
I had very peculiar errors when using client side cursors and I'm now not using them anymore for updating tables. Besides, you get better error messages when using server side cursors. For searching data in the result set, they are more flexible...

I also tested the whole case using first a server side cursor, and then a client side cursor, and that confirmed my theory that the cursor side cursor is the problem:

Public Sub test()
Dim cnn As ADODB.Connection
Dim TCtableRst As ADODB.Recordset
  
    Set cnn = New ADODB.Connection
    cnn.ConnectionString = \"driver={SQL Server};\" &                            \"server=OEBFASRV02;Trusted_Connection=Yes;database=InfoDB\"

    cnn.ConnectionTimeout = 15

    ' this prevents the update on a view!!
    'cnn.CursorLocation = adUseServer 

    ' this allows the update on a view!!
    cnn.CursorLocation = adUseClient  
    cnn.Open

  Set TCUtableRst = New ADODB.Recordset
  TCUtableRst.Open \"FrontPlan2\", cnn, adOpenDynamic, adLockPessimistic, adCmdTable

  TCUtableRst.MoveFirst
  On Error Resume Next
  TCUtableRst.fields(\"Bezeichnung\"«»).Value = \"Testvalue\"
  TCUtableRst.Update
  If Err  0 Then MsgBox Err.Description
  TCUtableRst.Close
  cnn.Close
End Sub


FrontPlan2 is a simple table having a varchar(100) field \"Bezeichnung\" that I update in the above example.

Is there a chance that you
1) offer the choice to select server side cursors for Database Browser connections, or
2) offer a \"readonly\" choice to disallow changes like MSQuery (which prevents editing already in the grid control)?

This is really a rather dangerous behaviour in this otherwise extremely useful product....

-regards,
ROland

Re:DatabaseBrowser: Updating Views though not gran 4 years ago #527

  • mike8888
  • OFFLINE
  • Expert Boarder
  • Posts: 131
  • Karma: 0
Please download version 2.2.5 and let us know the outcome

John

Re:DatabaseBrowser: Updating Views though not gran 4 years ago #529

  • roland
  • OFFLINE
  • Fresh Boarder
  • Posts: 4
  • Karma: 0
Seems to work quite fine. There is however one minor quirk still in there: In some views (I haven't found out which), database browser seems to update the value, although it doensn't really do (which only becomes apparent when you change/change back the viewed view). In other views it now correctly gives the \"update permission denied\" message.

-regards
Roland
  • Page:
  • 1
Time to create page: 0.19 seconds

Testimonials

Visual Importer ETL  saved us 25-30 hours per month. Much of that comes from being able to build in error checking into the scripting. I've even been able to script corrections that run on the fly triggered by the error checking on incoming order files.

Gene Kovacs,
Director of Technical Business Operations,
A2B

User Login

You only need to log in or register to use our support forum



Our customers

BP

BBC

HSBC


Databases we work with

Go to top