Semi-dynamic queries and database security

0
votes
openedge - Semi-dynamic queries and database security - Stack Overflow
Asked
Active 2 years, 11 months ago
Viewed 73 times
0

I know that plain Progress 4GL code with static buffers, find, for each etc. is subject to database security at compile-time (or additionally at run-time with the "Use Runtime Permissions Checking" option).

Dynamic queries are subject to database security at run-time only.

Does anyone know how code like in the following example would behave?

define query q for OrderLine.

DEFINE VARIABLE hQuery AS HANDLE NO-UNDO.

hQuery = QUERY q:HANDLE.

hQuery:QUERY-PREPARE("FOR EACH OrderLine NO-LOCK WHERE OrderLine.Itemnum = 100":U).
hQuery:QUERY-OPEN().

get first q.
do while available OrderLine:

  display OrderLine.Qty.

  get next q.

end.

close query q.
Improve this question
    0

    QUERY-PREPARE() and QUERY-OPEN() are executed at run-time, the compiler cannot evaluate what the arguments are at compile time so run time is when security will be applied.

    (Even though you used a static string for the arguments the compiler isn’t smart enough to do anything with it.)

    Improve this answer
    2
    • I didn't expect the compiler to evaluate the query-prepare string at compile time. What I'm interested in is if defining the query q for a fixed table and accessing the query through get first/next q and the name of the fixed table would do anything. Obviously the code wouldn't work if the query-prepare string doesn't match the definition of the query. Just tried what will happen in that case, the query-prepare will throw the error "<table> must be an unabbreviated name of a buffer known in query q. (7327)".
      – idspispopd
      Mar 5 2019 at 14:39
    • Security won’t be applied until you try to execute the query. “FOR orderLine” doesn’t impact that. So it is still run-time.
      – Tom Bascom
      Mar 5 2019 at 15:05

    Your Answer

    By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

    Not the answer you're looking for? Browse other questions tagged or ask your own question.

    Your privacy

    By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

     
    1
    openedgeprogress-4glprogress-db

    1 Answers

    0
    votes

    QUERY-PREPARE() and QUERY-OPEN() are executed at run-time, the compiler cannot evaluate what the arguments are at compile time so run time is when security will be applied.

    (Even though you used a static string for the arguments the compiler isn’t smart enough to do anything with it.)