I agree with Katrin; this is a very risky proposition and probably shouldn't be added to the Koha codebase. Not only is doing this securely hard, but it also makes the job of your system support specialist much harder (speaking as a former professional Koha support guy here). If you're in a situation where you cannot access MySQL directly, then there is a strong chance someone else is administrating the database (or entire Koha installation) for you. Making database-level changes through the GUI could result in massive damage to your data, and seriously ruin the day of your sysadmin. If you need to make these changes, I'd run it by whoever is responsible for the server, and hopefully they can help you do it in a safe/sane way. If you yourself are the administrator of the server, then you should be able to do this kind of work against MySQL directly, so adding a GUI-level interface would be unnecessary. -Ian On Mon, Apr 30, 2012 at 11:44, Fischer, Katrin <Katrin.Fischer@bsz-bw.de>wrote:
Hi Paul,****
** **
I really don’t like the idea. I think if you want someone to make changes to the database, you should give them a proper tool and training to do that (outside of Koha). The interface for statistics is very limited and does not give feedback when your SQL statements have errors or produce no result sets. Also it seems like a big security risk to me.****
** **
Katrin****
** **
*From:* koha-devel-bounces@lists.koha-community.org [mailto: koha-devel-bounces@lists.koha-community.org] *On Behalf Of *Jared Camins-Esakov *Sent:* Monday, April 30, 2012 5:21 PM *To:* Paul Poulain *Cc:* koha-devel@lists.koha-community.org *Subject:* Re: [Koha-devel] SQL reports [error]****
** **
Paul,****
** **
** **
On Mon, Apr 30, 2012 at 11:17 AM, Paul Poulain <paul.poulain@biblibre.com> wrote:****
Question to all = could it be a good idea to let superlibrarians execute dangerous SQLs like the one forbidden by the test ? Otherwise asked: could we add a unless permission eq 'superlibrarian' condition ?
( ie: "with great power comes great responsibility" -@spiderman uncle- )** **
** **
We were actually just discussing that on #koha a few days ago. I argued that only the database user (i.e. user 0) should be allowed to do it. If you have the direct login, there's nothing you can't do with the system just by logging into the database.****
** **
Regards,****
Jared ****
** **
-- Jared Camins-Esakov****
Bibliographer, C & P Bibliography Services, LLC****
(phone) +1 (917) 727-3445****
(e-mail) jcamins@cpbibliography.com****
(web) http://www.cpbibliography.com/****
** **
_______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/