Conference orarep::nomahs::odbc_rdb_driver

1304.0. "Datasource Read Only flag ignored" by ORAREP::MRSERV::PETERS () Wed Feb 19 1997 14:15

It appears an ODBC datasource Read Only flag can be ignored.

We have written a Visual Basic application which uses low level ODBC 
routines to access an RDB "reference" database. The application allows
the user to compose SQL statements that query this database and display
the query results in tabular format.

When the application starts up, it creates the appropriate datasource,
explicitly setting the Read Only flag. And, in fact, when the user
tries to alter the database, he gets the expected error.

HOWEVER, if the user enters an RDB SQL Attach statement to attach to that,
or another, database, then the user CAN make alterations to the table
data! This came as a complete surprise to us, as we assumed the Read Only
datasource flag meant ALL datasource access was on a Read Only basis.

Is this a serious security bug, or is there something we've overlooked?

Don

    If you want to secure your database do it on the server side. Set up
    the service so that it only has privilege to read the database.
    
    Setting the read only flag can help performance, but should not be
    regarded as a security measure. For one thing, it can be changed too
    easily. It does affect what the default transaction type is (as you
    saw), but can be overridden by applications that explicitly change the
    transaction types, or does things unsupported by ODBC, such as
    executing an attach statement.
    
    Peter

    as peter said in the previous reply, the read only flag only sets the
    default transaction. anyone who knows ODBC can write to a read only
    data source. 
    
    the read only flag was never intended as a security feature. again, use
    database protections in conjunction with database classes to maintain
    security on your Rdb db. 
    
    john