> > does nayone know of a way to allow a user to only have > > permission to execute stored procedures in sql server > > and not select, update, insert, delete permissions > > directly? i want people to only be able to access > > the data in my database from a sp and not directly > > using select, update, insert, delete. > > If you are doing this via the web, then you can use the CF > Administrator to do this. Select the DSN that you want to > execute only teh Sp, make sure that you chek the Stored > Procedures check box. If you are talking about using > enterprise manager, then you would need to create a login for > the users and allow only SP permissions on the database.
It's worth pointing out that this doesn't affect the actual rights of the user account used by CF, it only affects how CF will interact with that datasource. If your web server is compromised, there may be other ways to use that ODBC datasource besides CF - or in any case, the attacker could simply enable the appropriate settings within the CF Administrator! You always, ALWAYS, want to limit the actual rights of the user account within the database. Dave Watts, CTO, Fig Leaf Software http://www.figleaf.com/ voice: (202) 797-5496 fax: (202) 797-5444 ______________________________________________________________________ Your ad could be here. Monies from ads go to support these lists and provide more resources for the community. http://www.fusionauthority.com/ads.cfm FAQ: http://www.thenetprofits.co.uk/coldfusion/faq Archives: http://www.mail-archive.com/[email protected]/ Unsubscribe: http://www.houseoffusion.com/index.cfm?sidebar=lists
