Re: Using Views for security ?
In article <2d99coINN46s@emory.mathcs.emory.edu> cynthia@hpsgcip1.sgp.hp.com (Cynthia Leong) writes:
> Hello,
>
> Do you have any experience in using views for security purposes?
> If yes, please let me know :
> 1) How do you make use of it.
> 2) What are its limitations.
> 3) What are its strength
> 4) Any specific reason why you opt for views?
> 5) Maintenability
>
Regarding points 1) and 2), I guess that Informix Star (5.0) seems to
have a serious bug concerning the CHECK OPTION clause on remote views.
If you want to restrict data modification through a view by adding a
WITH CHECK OPTION to the CREATE VIEW statement, accesses to this view
from a different host are never rejected.
Consider the following scenario.
DATABASE db1@host1;
CREATE TABLE table1 ... ;
CREATE VIEW view1 AS SELECT ... FROM table1
WHERE <condition> WITH CHECK OPTION; {updatable view}
DATABASE db2@host2;
INSERT INTO db1@host1:view1 VALUES (...);{ condition violating INSERT, but it is not rejected by the database
server }
I have complained about this bug at out local Informix distributor,
but got no response up to now.
H.
--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
/M/A/I Deutschland GmbH Heinrich Seebauer
Softwarezentrum Koeln
Mathias-Brueggen-Str. 85 Software Engineering
50829 Koeln
Federal Republic of Germany
Phone: x221/956400-0 Phax: x221/956400-69 email: heinrich@mai.de
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=