Now this this is surprising. During my first presentation on ColdFusion 9 and ORM, I was asked about security permissions on DSNs and how they impact ORM. So for example, if you go into the Advanced Settings of a DSN and only allow certain operations (Select, Update, etc), will that impact ORM? I told the attendee that I honestly wasn't sure, but that I'd assume it would.
Turns out I was completely wrong. I edited one of my examples so that only SELECT operations were allowed. But this had no impact on the ORM operations I was allowed to do. I could still update, delete, and insert.
As I said - surprising - but I'm guessing that the DSN security operations must be something that ORM just doesn't go through.
Archived Comments
I always thought that permissions were better handled at the database level anyway so the restrictions applied no matter how a user accessed the database.
Im honestly not surprised by this, since the dsn security settings are meant to be applied to cfquery operations and the ORM is really a complete other layer where, I would bet, no cfqueries are used.
I agree with Gary that it's not surprising, but disagree about the rationale, as it requires a bit of a retcon to make sense. Obviously those settings didn't consider the ORM integration previously (only considering CFQUERY and CFSTROEDPROC), because the ORM integration didn't exist when they were implemented.
However now the ORM integration is there, and it's tied to the DSN so it should respect the settings of the DSN.
I would say this is an oversight on the part of the Adobe dev team, not the result of a specific decision being made. And I think it's a bug.
And, lastly: well-spotted, Ray!
--
Adam
The DSN security stuff has never worked well. Set a select only DSN, then execute a query with multiple parts.. it'll only stop you if the first action the query takes isn't a select. Much safer to have multiple DSNs with different users and only use the higher permission level DSNs where the code actually requires it.
Probably good grounds for raising an enhancement request / bug fix, I'd say: http://cfbugs.adobe.com/cfb...
--
Adam
Thanks Ray, I'll update my co-worker who asked that! Good to know..
Thanks again for a great presentation of CF and ORM!
Not to nitpick but the last sentence uses the acronym DNS instead of DSN.
Fixed. Thanks.
Not to nitpick, but neither "DSN" or "DNS" are acronyms.
But I'm sure your nitpick had more value than this one here ;-)
--
Adam
@Adam. I agree your are correct. But also note, that definition has altered since I was a kid (and perhaps you). It is now an open debate. So I may be correct too. Some view acronyms and initialisms as synonymous. The best example of this is <a href="http://www.merriam-webster...." target="_blank">Webster's</a> definition. Wikipedia also describes the debate. But boy, now we are way off original topic. :)
I guess I forgot how to format a link in blog comments ... see here http://www.merriam-webster.... .