Gossamer Forum
Home : Products : Gossamer Links : Version 1.x :

Re: Wishlist / wantlist

Quote Reply
Re: Wishlist / wantlist In reply to
 
Quote:
I'm not sure what you mean here. Do you mean multiple admin's who all have the same access? Or multiple admin's, each managing a section of the directory?

I mean multiple admins with different access levels.

Right now, the admin logs on as the general user with full privs. I have problems with the log-ons being hard coded anyway.... It's a real security problem. "read" access to the databaes, or write access to the Validate table is reasonable, but there is no reason the same password has to be used for all scripts.

What should be implemented is an input-password, and that password is used for all transactions during that session.

The default admin password should give 'read' access to the tables. An admin or editors password needs to be entered to allow additional access.

This is part of MySQL. All LinkSQL has to do is handle the password properly.

For simplicity sake, the current implementation can be the default implementation. But, for those who want to implement a higher security, and can deal with the MySQL priv tables on their own, the ability to use a supplied rather than default password should be added.

Now, I know this can cause problems down the line, since the routines are set up to modify records, not columns, but I see this as a necessary migration.

First, allowing a supplied password.

Then, with process_query the editor privs are checked, and only the fields that are able to be modified are updated so the query doesn't fail with an error.

LinkSQL has to handle the privs, but not the security... that's in MySQL. If the password is wrong, the command will fail. LinkSQL has to generate the proper query and handle errors if a request fails to report bad password or improper fields.

Subject Author Views Date
Thread Wishlist / wantlist pugdog 3661 Jul 15, 1999, 12:45 PM
Post Re: Wishlist / wantlist
pugdog 3582 Jul 16, 1999, 6:31 AM
Post Re: Wishlist / wantlist
Alex 3581 Jul 19, 1999, 9:38 PM
Post Re: Wishlist / wantlist
pugdog 3578 Aug 27, 1999, 9:15 PM
Post Re: Wishlist / wantlist
rcjordan 3581 Aug 28, 1999, 10:42 AM
Post Re: Wishlist / wantlist
Alex 3582 Aug 29, 1999, 9:01 PM
Post Re: Wishlist / wantlist
pugdog 3580 Aug 29, 1999, 9:48 PM
Post Re: Wishlist / wantlist
Alex 3582 Aug 30, 1999, 12:11 PM