Re: permissions?

From: Aquila Deus (aquila_deus_at_yahoo.co.uk)
Date: 09/21/04 

Date: 21 Sep 2004 00:07:44 -0700

kkk333@freemail.hu (Daniel Barna) wrote in message news:<468adf60.0409191417.3a8c7552@posting.google.com>...
> Hi
> I have the following problem: I want to grant different access rights
> to different users on a page, identified by username/password. I want
> to load the set of users/passwords from a database, from a file, or
> whereever. This is more or less OK: outside users connecting via the
> web can sent their username/password ($_POST variable), the script
> checks it agains the users/passwords in the database, and grants
> different access rights according to the username.
> However, this is not safe against local users of the same machine:
> since the php script of every local user runs under the same uid/gid,
> every user can access the same database using a php script. One could
> argue, that they can not figure out, how to access this database
> (where it is located, if it requires a password, etc). But since my
> php script must be readable by the www server (user=wwwrun), they can
> read this script from a php script, which runs under the same uid.

If the users use only database resource, how about just use database's
built-in security system?

>
> I have found some articles about setting up different vhosts in
> apache, and running these vhosts with different UID. But this needs
> apache-configuration, as root. Is there a per-user way, which any user
> can follow without the intervention of root, to set up a database,
> which is only accessible by his php scripts?

don't forget vhost can't be set without restarting apache... Besides,
only root can change his own uid (unless you use nt), so that any
system-level methods can't work for you.

Relevant Pages

  • permissions?
    ... I want to grant different access rights ... to different users on a page, identified by username/password. ... checks it agains the users/passwords in the database, ... every user can access the same database using a php script. ...
    (comp.lang.php)
  • Re: Need help with using HTTP from VBA in Access 2003.
    ... Please don't multipost the same question in three different newsgroups, ... I need to interact with a MySQL database via HTTP strings. ... The PHP script executes the query and sends back the results in XML. ...
    (microsoft.public.access.forms)
  • Re: Re: Need help with using HTTP from VBA in Access 2003.
    ... was for a charity to tutor disadvantaged youth, yada, yada, yada. ... I need to interact with a MySQL database via HTTP strings. ... The PHP script executes the query and sends back the results in XML. ...
    (microsoft.public.access.forms)
  • Re: Re: Need help with using HTTP from VBA in Access 2003.
    ... See http://www.QBuilt.com for all your database needs. ... was for a charity to tutor disadvantaged youth, yada, yada, yada. ... I need to interact with a MySQL database via HTTP strings. ... The PHP script executes the query and sends back the results in XML. ...
    (microsoft.public.access.forms)
  • Re: mysql_query(): supplied argument is not a valid MySQL-Link resource
    ... When I had my first attempt at using functions in a PHP script I had similar ... I got round it by passing all variables outside the function into ... > close a connection to the database very time I run a query. ...
    (comp.lang.php)