Re: Protect
This WebDNA talk-list message is from 1997
It keeps the original formatting.
numero = 14252
interpreted = N
texte = >>>>Are you on NT? Have you restarted recently? Have you flushed the >>>>databases since beginning to mess with this? What are a few of the >>>>actual users.db files that don't seem to work? Can you include one of >>>>the HTML pages that doesn't work? >> >>>No I am an all Mac site. I am running WebTen with many domains. Some of >>>these are stores for individual companies. After they are set up I turn >>>them over to the company they belong to. >> >>Okay then, here's how to get this stuff to work the way I think you >>want it to work. >> >>All you have to do is to give each company its own private group. In >>other words, if you have a company named ABC Company. then start by >>creating a group name ABC. >> >>Next, go into that company's admin templates and replace all the >>protect tags in those templates with >> >>[protect abc] >> >>Then go into the users.db and find your personal users.db record -- >>it should have ADMIN as one of the words in the groups field --- and >>add the new group name ABC to YOUR group field. >> >>Now, go into the users.db record of everyone in the ABC Company who >>is supposed to have access to the admin pages of that firm, and >>replace everything that's in the groups field in those records with >>the group name ABC. Do NOT leave ADMIN in ANY of the groups >>fields in these records! >> >>Okay, now, do you see what that has done? >> >>First of all, it has gotten rid of ADMIN in the group fields of >>everyone in the ABC Company, which means NO ONE in the ABC company >>can gain access to the pages you have protected with the [protect >>admin] page. >> >>Second, it has given only the ABC Company's people (and you, >>personally) access to the ABC Company's templates and databases. You >>still have personal access to the [protect ABC] pages because you put >>the ABC group name into the groups field in your own users.db record, >>remember? >> >>One of the main things to rememeber is to NEVER give anyone outside >>*your own company* ADMIN access. In fact, if I were you, I would make >>sure that you, personally, and the ONLY one with ADMIN access. >> >>Sincerely, Ken Grome >>WebDNA Solutions >>808-737-6499 >>http://www.smithmicro.com/webdnasolutions/ >> >I have done all this. I think you are missing the point. If they can >modify their own database then their is no reason I can find they can't >modify someone else's. They just write some new code.What do you mean They just write some new code.?There's a HUGE difference between letting people modify database information from the templates YOU have created, and letting them create THEIR OWN templates, which is the point I'm trying to get across to you.If your users CANNOT use $commands, and if they CANNOT create their own templates, there's no way on Earth that they can POSSIBLY modify someone else's data -- unless YOU give them that ability, either in the templates you've given them access to, or else from some *other* program you're running on your server.What I'm TRYING to tell you is that you should *NEVER* allow your users write *ANY* WebDNA code in *ANY* templates, at least without your checking those templates *BEFORE* they get loaded onto the server ...Sincerely, Ken Grome WebDNA Solutions 808-737-6499 http://www.smithmicro.com/webdnasolutions/.
Associated Messages, from the most recent to the oldest:
>>>>Are you on NT? Have you restarted recently? Have you flushed the >>>>databases since beginning to mess with this? What are a few of the >>>>actual users.db files that don't seem to work? Can you include one of >>>>the HTML pages that doesn't work? >> >>>No I am an all Mac site. I am running WebTen with many domains. Some of >>>these are stores for individual companies. After they are set up I turn >>>them over to the company they belong to. >> >>Okay then, here's how to get this stuff to work the way I think you >>want it to work. >> >>All you have to do is to give each company its own private group. In >>other words, if you have a company named ABC Company. then start by >>creating a group name ABC. >> >>Next, go into that company's admin templates and replace all the >>protect tags in those templates with >> >>[protect abc] >> >>Then go into the users.db and find your personal users.db record -- >>it should have ADMIN as one of the words in the groups field --- and >>add the new group name ABC to YOUR group field. >> >>Now, go into the users.db record of everyone in the ABC Company who >>is supposed to have access to the admin pages of that firm, and >>replace everything that's in the groups field in those records with >>the group name ABC. Do NOT leave ADMIN in ANY of the groups >>fields in these records! >> >>Okay, now, do you see what that has done? >> >>First of all, it has gotten rid of ADMIN in the group fields of >>everyone in the ABC Company, which means NO ONE in the ABC company >>can gain access to the pages you have protected with the [protect >>admin] page. >> >>Second, it has given only the ABC Company's people (and you, >>personally) access to the ABC Company's templates and databases. You >>still have personal access to the [protect ABC] pages because you put >>the ABC group name into the groups field in your own users.db record, >>remember? >> >>One of the main things to rememeber is to NEVER give anyone outside >>*your own company* ADMIN access. In fact, if I were you, I would make >>sure that you, personally, and the ONLY one with ADMIN access. >> >>Sincerely, Ken Grome >>WebDNA Solutions >>808-737-6499 >>http://www.smithmicro.com/webdnasolutions/ >> >I have done all this. I think you are missing the point. If they can >modify their own database then their is no reason I can find they can't >modify someone else's. They just write some new code.What do you mean They just write some new code.?There's a HUGE difference between letting people modify database information from the templates YOU have created, and letting them create THEIR OWN templates, which is the point I'm trying to get across to you.If your users CANNOT use $commands, and if they CANNOT create their own templates, there's no way on Earth that they can POSSIBLY modify someone else's data -- unless YOU give them that ability, either in the templates you've given them access to, or else from some *other* program you're running on your server.What I'm TRYING to tell you is that you should *NEVER* allow your users write *ANY* WebDNA code in *ANY* templates, at least without your checking those templates *BEFORE* they get loaded onto the server ...Sincerely, Ken Grome WebDNA Solutions 808-737-6499 http://www.smithmicro.com/webdnasolutions/.
Kenneth Grome
DOWNLOAD WEBDNA NOW!
Top Articles:
Talk List
The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...
Related Readings:
New Command prefs ... (1997)
[format 40s]text[/format] doesn't work (1997)
Size limit for tmpl editor ? (1997)
[decrypt seed=seed][getchars (1999)
WebCat Mac OS X and Encrypt Help Need (2000)
[ENCRYPT seed=xxxxx] length (2000)
WebDNA 5.0 Enterprise Edition (2003)
WC2b15 File Corruption (1997)
PCS Frames (1997)
synching databases on multiple servers (1997)
Replacing a Word (1999)
ReadDateFormat bug in 3.x (1998)
[Switch] - works great, suggestion (2000)
[ShowIf] and empty fields (1997)
Getting total number of items ordered (1997)
[ShowIf] a either fields are blank (1998)
[BULK] [WebDNA] Version 7 Config problem (2011)
searchable list archive (1997)
Initiating NewCart (1997)
I've been thinking (2002)