store procedure security issue

Question

Hello everyone,

I am not sure whether it is possible to setup a security policy like this with store procedure. The user account foo could only access database through store procedure, not possible to do other operations, like select/update on the tables of the database directly without using the store procedure.

My store procedure is doing some select/update job. My confusion is, as the user needs to use the store procedure and the store procedure is doing select/update job, then I have to grant the user to have select/update privilege of the database tables? Then the user could skip using the store procedure and select/update database tables directly which causes a security hole. My purpose is to let user use store procedure all the time, no walk around to access database without using store procedure.

Any advice to solve my probleme?

thanks in advance,
George

Answer 1

Oops. Hit post too early. You could put some programming in the Pre-Init, too. That doesn't solve the null in the session variable, but it would fire before the page load.

Answer 2

I'm not familiar with I-frame, but some ideas that come to mind...
1. The last time I couldn't find a Session variable I was CERTAIN I had, I didn't have enable session state set to true.
2. Another thought is that it might not be set before the other event fires
3. Are you sure all the names that reference the Session variable are the same including capitol letters and exact spelling (I depend on Intellisense a LOT, so I'm forever mistyping the Session Variable names).
4. If all else fails, I would put some temporary variables and breakpoints in during debug to see when the Session Variable loses its value.

HTH

Answer 3

Well... there's nothing special about the code. Basically what I've done to test it is just set the menu item's NavigateURL, it's Target, and I added some text to it's Value property.

Then in the Item Cleck event I just add the Value to a Session variable. As soon as the other page loads I call the session variable to see if it actually added anything. Then the page complains about the Session Variable... "not set to an instance of an object...".

But if I try the same without the iFrame it works.


Why I want to di this:
I have a few pages in which my client's clients can fill in Details about the item they want to add to there insurance or Amend and item. The add and amend is almost the same and thus I want to try and use the same page for both. But I need to know what was clicked so that I know if the user wants to add or amend.

I hope it makes sense.

Thanks

Answer 4

Sounds like a coding error. You might post some relevant code so we can see what you're doing.