security bug found

[Christo Kutrovsky]

When you're logged in as a DBA (system for example) and you use the browser tree, and expand:

USERS->a specific user->objects->Tables->a table

and you view the properties of the table, you do not see all the grants.

This is a huge security issue, as I may not see grants to that table, and assume wrongly that no-one should be able to write to that table.

 

[Christo Kutrovsky]

NOTE that even openening the priviliges on the user does not show the tables.

I just found out that this is because I have unchecked "Use dba views if available".

So you should add some kind of warning into those pages, when this option is uncheked.

 

[Marco Kalter]

Maybe we should change the default value of this preference.

 

[Christo Kutrovsky]

I think you need more like a warnning.

because I knew about this option, and I had to uncheck it for some connections. But i had forgoten, and I did not know about this little side effect.