| Oracle FAQ | Your Portal to the Oracle Knowledge Grid | |
 |
 | |||
| Oracle FAQ | Your Portal to the Oracle Knowledge Grid | |
|
| |||
Home -> Community -> Mailing Lists -> Oracle-L -> (no subject)
I can explain it easily -- the owner of the package has write access to the table. And the user who has execute privs on the package inherits (for the time the package is running, and only for the running of that package) all the privileges the package owner has.
Now, in 8 (I *think* 8.0 but certainly 8i) you can create packages that run with the invoker's rights. So a user who did not have write access to that table would not be able to write into it, even if he had execute on the package itself.
>From: "Krishnan, Manjula R." <MRKrishn_at_dcss.com>
>Reply-To: ORACLE-L_at_fatcity.com
>To: Multiple recipients of list ORACLE-L <ORACLE-L_at_fatcity.com>
>Date: Fri, 22 Jun 2001 12:00:41 -0800
>
>Dear DBA's:
>
>Have any of you come across this bizzare behavior? We have an application
>that was written using Forms 6i. It runs on the web (using OAS 4.0.8.2) on
>an 8i database.
>
>A user has been granted access through a role. This role APP_READ only has
>select privileges on all the tables for the application. But, on one of the
>forms the user is able to write into a table. This form uses a package to
>write into the table. The role has execute on the package. I checked the
>form code to see if there was any explicit connect. There was none. I even
>recreated the user and the same thing is happening.
>
>Can anyone explain this?
>
>Thanks,
>
>Manjula
>--
>Please see the official ORACLE-L FAQ: http://www.orafaq.com
>--
>Author: Krishnan, Manjula R.
> INET: MRKrishn_at_dcss.com
>
>Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051
>San Diego, California -- Public Internet access / Mailing Lists
>--------------------------------------------------------------------
>To REMOVE yourself from this mailing list, send an E-Mail message
>to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
>the message BODY, include a line containing: UNSUB ORACLE-L
>(or the name of mailing list you want to be removed from). You may
>also send the HELP command for other information (like subscribing).
-- Please see the official ORACLE-L FAQ: http://www.orafaq.com -- Author: Rachel Carmichael INET: carmichr_at_hotmail.com Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051 San Diego, California -- Public Internet access / Mailing Lists -------------------------------------------------------------------- To REMOVE yourself from this mailing list, send an E-Mail message to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing).Received on Fri Jun 22 2001 - 14:18:45 CDT
 |
 |