dbTalk Databases Forums  

How to prevent a user from viewing code of procedure or funtion

sybase.public.sqlanywhere.general sybase.public.sqlanywhere.general


Discuss How to prevent a user from viewing code of procedure or funtion in the sybase.public.sqlanywhere.general forum.



Reply
 
Thread Tools Display Modes
  #1  
Old   
Heiko Helbig
 
Posts: n/a

Default How to prevent a user from viewing code of procedure or funtion - 12-09-2009 , 09:17 AM






I was creating a new user with only SELECT permission on some tables
owned by DBA.
If I connect this database using this new user it is possible to see
content of all procedures and functions.
Wow to prevent an user to see this this code?

Reply With Quote
  #2  
Old   
Reg Domaratzki [Sybase iAnywhere]
 
Posts: n/a

Default Re: How to prevent a user from viewing code of procedure or funtion - 12-09-2009 , 09:34 AM






Heiko Helbig wrote:
Quote:
I was creating a new user with only SELECT permission on some tables
owned by DBA.
If I connect this database using this new user it is possible to see
content of all procedures and functions.
Wow to prevent an user to see this this code?
Yes, any user with connect permissions can see procedure code by
default. You can obfuscate the source with the following command :

ALTER PROCEDURE p1 SET HIDDEN;

--
Reg Domaratzki, Sybase iAnywhere Solutions
Please reply only to the newsgroup

Documentation : Exercise your WRITE @DocCommentXchange: DCX.sybase.com
SQL Anywhere Patches and EBFs : http://downloads.sybase.com/swd/base.do
-> Choose SQL Anywhere
-> Optionally set filter to "Display ALL platforms IN ALL MONTHS"

Reply With Quote
  #3  
Old   
Nick Elson [Sybase iAnywhere]
 
Posts: n/a

Default Re: How to prevent a user from viewing code of procedure or funtion - 12-09-2009 , 12:15 PM



In addition to hiding stored procedures, there are SET HIDDEN clauses
for the ALTER FUNCTION, ALTER EVENT, ALTER VIEW,
and ALTER TRIGGER statements as well. And if you use @configuration
files you can obfuscate those with the dbfhide as well.

All in all there should be a way to protect your intelligent properties
with one of the above (and below) features.

"Reg Domaratzki [Sybase iAnywhere]" <firstname.lastname (AT) ianywhere (DOT) com> wrote
in message news:4b1fc3a3$1 (AT) forums-1-dub (DOT) ..
Quote:
Heiko Helbig wrote:
I was creating a new user with only SELECT permission on some tables
owned by DBA.
If I connect this database using this new user it is possible to see
content of all procedures and functions.
Wow to prevent an user to see this this code?

Yes, any user with connect permissions can see procedure code by default.
You can obfuscate the source with the following command :

ALTER PROCEDURE p1 SET HIDDEN;

--
Reg Domaratzki, Sybase iAnywhere Solutions
Please reply only to the newsgroup

Documentation : Exercise your WRITE @DocCommentXchange: DCX.sybase.com
SQL Anywhere Patches and EBFs : http://downloads.sybase.com/swd/base.do
-> Choose SQL Anywhere
-> Optionally set filter to "Display ALL platforms IN ALL MONTHS"

Reply With Quote
  #4  
Old   
Heiko Helbig
 
Posts: n/a

Default Re: How to prevent a user from viewing code of procedure or funtion - 12-10-2009 , 03:12 AM



Many thanks to both of you. I will try this immediately.

Am 09.12.2009 19:15, schrieb Nick Elson [Sybase iAnywhere]:
Quote:
In addition to hiding stored procedures, there are SET HIDDEN clauses
for the ALTER FUNCTION, ALTER EVENT, ALTER VIEW,
and ALTER TRIGGER statements as well. And if you use @configuration
files you can obfuscate those with the dbfhide as well.

All in all there should be a way to protect your intelligent properties
with one of the above (and below) features.

"Reg Domaratzki [Sybase iAnywhere]" <firstname.lastname (AT) ianywhere (DOT) com
wrote

Heiko Helbig wrote:
I was creating a new user with only SELECT permission on some tables
owned by DBA.
If I connect this database using this new user it is possible to see
content of all procedures and functions.
Wow to prevent an user to see this this code?

Yes, any user with connect permissions can see procedure code by
default. You can obfuscate the source with the following command :

ALTER PROCEDURE p1 SET HIDDEN;

--
Reg Domaratzki, Sybase iAnywhere Solutions
Please reply only to the newsgroup

Documentation : Exercise your WRITE @DocCommentXchange: DCX.sybase.com
SQL Anywhere Patches and EBFs : http://downloads.sybase.com/swd/base.do
-> Choose SQL Anywhere
-> Optionally set filter to "Display ALL platforms IN ALL MONTHS"

Reply With Quote
  #5  
Old   
Nick Elson [Sybase iAnywhere]
 
Posts: n/a

Default Re: How to prevent a user from viewing code of procedure or funtion - 12-10-2009 , 09:11 AM



Good luck then.

One caveat though ... this facility uses a one-way encryption.
You have be make certain that you keep a source copy around
(secured outside the database) so you can make your changes.

"Heiko Helbig" <hhelbig (AT) becomsoft (DOT) com> wrote

Quote:
Many thanks to both of you. I will try this immediately.

Am 09.12.2009 19:15, schrieb Nick Elson [Sybase iAnywhere]:
In addition to hiding stored procedures, there are SET HIDDEN clauses
for the ALTER FUNCTION, ALTER EVENT, ALTER VIEW,
and ALTER TRIGGER statements as well. And if you use @configuration
files you can obfuscate those with the dbfhide as well.

All in all there should be a way to protect your intelligent properties
with one of the above (and below) features.

"Reg Domaratzki [Sybase iAnywhere]" <firstname.lastname (AT) ianywhere (DOT) com
wrote

Heiko Helbig wrote:
I was creating a new user with only SELECT permission on some tables
owned by DBA.
If I connect this database using this new user it is possible to see
content of all procedures and functions.
Wow to prevent an user to see this this code?

Yes, any user with connect permissions can see procedure code by
default. You can obfuscate the source with the following command :

ALTER PROCEDURE p1 SET HIDDEN;

--
Reg Domaratzki, Sybase iAnywhere Solutions
Please reply only to the newsgroup

Documentation : Exercise your WRITE @DocCommentXchange: DCX.sybase.com
SQL Anywhere Patches and EBFs : http://downloads.sybase.com/swd/base.do
-> Choose SQL Anywhere
-> Optionally set filter to "Display ALL platforms IN ALL MONTHS"

Reply With Quote
Reply




Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Powered by vBulletin Version 3.5.3
Copyright ©2000 - 2012, Jelsoft Enterprises Ltd.