Intriguing OleDB problem

[eek]

It is not running in the context of IUSER, rather the context of the application pool. .Net has supported impersonation for years.

I'd read up on it if I were you.

HTH

I agree someone needs to do some reading up on security. Unfortunately its not me.

[d000hg]

I love you all equally Doogie, no need to seek attention.

It was a serious question. CUK is the last place I'd ask a programming question simply due to the very small number of people here... on SO you get answers from the people who designed the technologies in the first place sometimes!

And could you keep the spats for General... there's special thread for it and everything!

[suityou01]

It was a serious question. CUK is the last place I'd ask a programming question simply due to the very small number of people here... on SO you get answers from the people who designed the technologies in the first place sometimes!

And could you keep the spats for General... there's special thread for it and everything!

Sound advice.

I did not want a spat. I think Eek has rather let himself down with his childish rants. If he had simply said

"Fair enough, if it works it works, however be aware that you have potentially caused the following issues ....."

This would have been a level headed and mature response, worthy of a time seasoned contractor. Instead, well, the least said the better.

Oh, and for the record, he has a history of splurging my requests for help in technical all over General. Newcomers to the forum may see this and decide to refrain from posting in technical on the strength of this. Just saying like

[d000hg]

Oh, and for the record, he has a history of splurging my requests for help in technical all over General. Newcomers to the forum may see this and decide to refrain from posting in technical on the strength of this. Just saying like

Personally I think his attempt to post proper answers here and then mock you about it in General is better than complaining the answers aren't good enough

[suityou01]

Examples please as I don't believe I'm the prime culprit for taking your crap from technical and posting it in general.

i'll admit to other examples but that was firstly to give you a laugh, to ensure that MF and others replied and because that was the most appropriate place for it to be. From memory the advice you got in general was better than the advice in Business and Contracts anyway.

As for ranting I'm trying to work out how many others have agreed with you so far.

I love it when you back pedal

[eek]

I had deleted that.

If you want to attack me do it in general. If you are brave enough.

[suityou01]

I had deleted that.

If you want to attack me do it in general. If you are brave enough.

Really don't as I am a grown up with better things to do.

HTH

[doodab]

There is a reason why the IUSR user has very minimal access rights

It is not running in the context of IUSER, rather the context of the application pool. .Net has supported impersonation for years.

That's the point he's trying to make. Good security practice is to give the app the least privileges required to do what it needs to do i.e. give it permission to the oracle home directory. By choosing to impersonate another user you have, as a side effect, given it access to everything that user can access which probably includes lots and lots of other things that it doesn't need and probably shouldn't have access to. If the web app were to be exploited and an attacker able to run arbitrary code the range of things they could do is now significantly wider.

[d000hg]

Really don't as I am a grown up with better things to do.

Like writing your passive-aggressive signature? Did you have to consult SQL for Dummies?

[TheFaQQer]

Like writing your passive-aggressive signature? Did you have to consult SQL for Dummies?

SELECT User_Id IgnoresList FROM CUK_USERS WHERE USER_NAME = 'EEK' OR USER_CAN_SPELL = FALSE;

ignoreList

Oh, the irony

(And since user_name is case sensitive, the query would return no rows anyway)