file:write ADMIN permission needed
Tuesday, 12 July 2011 · 4 messages · last reply 14 Jul 2011
IV
Isidro Vila Verde12 Jul 2011 18:38 #
Dear All,
I am trying to use xquery
file:write function to create new documents but it seems only ADMIN users can do that.
This is a little bit limited (IMHO) as I don't want to give admin privileges to my users.
In other hand, it also seems incoherent as the user can add documents to data base directly from command line.Quoted text · 1 line
> add as t.xml <r/>
Path '/t.xml' added in 24.72 ms.
Quoted text · 1 line
> xquery declare namespace fx="http://expath.org/ns/file";
fx:write('file1.xml','<w/>')
Stopped at line 1, column 78:
[BASX0005] ADMIN permission needed.
Quoted text · 1 line
> xquery declare namespace fx="http://expath.org/ns/file";
fx:write('./file1.xml','<w/>')
Stopped at line 1, column 80:
[BASX0005] ADMIN permission needed.
Quoted text · 1 line
> xquery declare namespace fx="http://expath.org/ns/file";
fx:write('/f.xml','<w/>')
Stopped at line 1, column 75:
[BASX0005] ADMIN permission needed.
Quoted text · 1 line
>
---------------------------------------------------------------------------------------------------------------------------------
I also try to give the user ADMIN privileges to the correspondent database but although it seems possible in the HELP, the fact is that it is not.
Quoted text · 1 line
> show users on test
Username Read Write
---------------------
test X X
1 Users.
Quoted text · 1 line
> help grant
GRANT [NONE|READ|WRITE|CREATE|ADMIN] (ON [database]) TO [user] Grant user permissions.
Grants permissions (on a database) to a user.
Quoted text · 1 line
> grant admin on test to test
ADMIN permission is unknown.
Quoted text · 1 line
> grant create on test to test
CREATE permission is unknown.
Quoted text · 1 line
>
So, my question is: These are bugs, limitations, or some kind of wrong understood on my part?
Thanks
Isidro
---
avast! Antivirus: Outbound message clean.
Virus Database (VPS): 110712-0, 12-07-2011
Tested on: 12-07-2011 17:38:29
avast! - copyright (c) 1988-2011 AVAST Software.
http://www.avast.com
CG
Christian Grün12 Jul 2011 22:33 #
Isidro,
thanks for your mail.
Quoted text · Isidro Vila Verde · 4 lines
> I am trying to use xquery file:write function to create new documents but it > seems only ADMIN users can do that. > This is a little bit limited (IMHO) as I don't want to give admin privileges > to my users.
The main reason here is that
file:write() is part of the file module, in which all functions require ADMIN rights. Next, the file:write() function can be used in a destructive way as well. For example, it can be used to overwrite other database files, or change configuration files that are otherwise only accessible to the admin user. So I'm sorry that this constraint might be too restrictive for your scenario. We are open for alternative suggestions that cover security issues like the mentioned one (some things would be easier if we coupled user management to the operating system, but as we want to stay platform independent, we introduced our own user management).Quoted text · Isidro Vila Verde · 2 lines
> I also try to give the user ADMIN privileges to the correspondent database > but although it seems possible in the HELP, the fact is that it is not.
The help output on command line is probably too compact to give you all the details. Please have a look into our documentation instead:
http://docs.basex.org/wiki/User_Management
http://docs.basex.org/wiki/Commands
Feel free to ask for more,
Christian
IV
Isidro Vila Verde13 Jul 2011 13:11 #
Thanks Christian,
I'm afraid I am not in position to suggest any alternative, but in fact adding documents to collections is something that (IMHO) should be possible in xquery. I was accustomed to doing that in exist-db. But if it is not possible, I will have to find a possible alternative.
Thanks for your quick answer
Isidro
Em 12-07-2011 21:33, Christian Grün escreveu:
Quoted text · Christian Grün · 40 lines
> Isidro, > > thanks for your mail. > >> I am trying to use xquery file:write function to create new documents but it >> seems only ADMIN users can do that. >> This is a little bit limited (IMHO) as I don't want to give admin privileges >> to my users. > The main reason here is that file:write() is part of the file module, > in which all functions require ADMIN rights. Next, the file:write() > function can be used in a destructive way as well. For example, it can > be used to overwrite other database files, or change configuration > files that are otherwise only accessible to the admin user. So I'm > sorry that this constraint might be too restrictive for your scenario. > We are open for alternative suggestions that cover security issues > like the mentioned one (some things would be easier if we coupled user > management to the operating system, but as we want to stay platform > independent, we introduced our own user management). > >> I also try to give the user ADMIN privileges to the correspondent database >> but although it seems possible in the HELP, the fact is that it is not. > The help output on command line is probably too compact to give you > all the details. Please have a look into our documentation instead: > > http://docs.basex.org/wiki/User_Management > http://docs.basex.org/wiki/Commands > > Feel free to ask for more, > Christian > > > --- > avast! Antivirus: Inbound message clean. > Virus Database (VPS): 110712-1, 12-07-2011 > Tested on: 12-07-2011 22:21:42 > avast! - copyright (c) 1988-2011 AVAST Software. > http://www.avast.com > > >
---
avast! Antivirus: Outbound message clean.
Virus Database (VPS): 110712-1, 12-07-2011
Tested on: 13-07-2011 12:11:46
avast! - copyright (c) 1988-2011 AVAST Software.
http://www.avast.com
CG
Christian Grün14 Jul 2011 03:31 #
Dear Isidro,
Quoted text · Isidro Vila Verde · 4 lines
> I'm afraid I am not in position to suggest any alternative, but in fact > adding documents to collections is something that (IMHO) should be possible > in xquery. I was accustomed to doing that in exist-db. > But if it is not possible, I will have to find a possible alternative.
by chance, we're currently adding some database functions to support collection updates from within XQuery:
https://github.com/BaseXdb/basex/issues/73
The new release is planned for end of this month (shortly before the Balisage Conference).
More suggestions are welcome,
Christian
Quoted text · Isidro Vila Verde · 64 lines
> Em 12-07-2011 21:33, Christian Grün escreveu: >> >> Isidro, >> >> thanks for your mail. >> >>> I am trying to use xquery file:write function to create new documents but >>> it >>> seems only ADMIN users can do that. >>> This is a little bit limited (IMHO) as I don't want to give admin >>> privileges >>> to my users. >> >> The main reason here is that file:write() is part of the file module, >> in which all functions require ADMIN rights. Next, the file:write() >> function can be used in a destructive way as well. For example, it can >> be used to overwrite other database files, or change configuration >> files that are otherwise only accessible to the admin user. So I'm >> sorry that this constraint might be too restrictive for your scenario. >> We are open for alternative suggestions that cover security issues >> like the mentioned one (some things would be easier if we coupled user >> management to the operating system, but as we want to stay platform >> independent, we introduced our own user management). >> >>> I also try to give the user ADMIN privileges to the correspondent >>> database >>> but although it seems possible in the HELP, the fact is that it is not. >> >> The help output on command line is probably too compact to give you >> all the details. Please have a look into our documentation instead: >> >> http://docs.basex.org/wiki/User_Management >> http://docs.basex.org/wiki/Commands >> >> Feel free to ask for more, >> Christian >> >> >> --- >> avast! Antivirus: Inbound message clean. >> Virus Database (VPS): 110712-1, 12-07-2011 >> Tested on: 12-07-2011 22:21:42 >> avast! - copyright (c) 1988-2011 AVAST Software. >> http://www.avast.com >> >> >> > > > > --- > avast! Antivirus: Outbound message clean. > Virus Database (VPS): 110712-1, 12-07-2011 > Tested on: 13-07-2011 12:11:46 > avast! - copyright (c) 1988-2011 AVAST Software. > http://www.avast.com > > > > _______________________________________________ > BaseX-Talk mailing list > BaseX-Talk at mailman.uni-konstanz.de > https://mailman.uni-konstanz.de/mailman/listinfo/basex-talk >
Written for BaseX 6.7. BaseX may have changed since: please check the current documentation.
⚡Generated with XQuery