0

I (a geographer not to familiar with IT stuff) want to start a pilot with QGIS at a municipality I work for. We store our data in Oracle databases. When trying to open these databases (QGIS 2.2) using 'adding oracle spatial layer', the error massage gives information which should be undisclosed, such as passwords. Also, I'm able to view databases I shouldn't have access too. Therefore, the safety of the database is not guaranteed and we cannot test this software.

Does anyone know if QGIS will work on future releases where rule based system (as in different levels of access and control) for Oracle spatial will be possible?

This will give me the opportunity to use it at our municipality.

  • 3
    If you can see something forbidden with the user account you use in QGIS you would see all the same with SQL*Plus. Contact DB admins and they will take extra rights away from you. Undisclosed information in error messages is a bug. Contact QGIS developers. – user30184 Jun 16 '14 at 13:27
  • 1
    Sounds like an METADATA and user restriction on the data. We use QGIS in DEV,TEST,Production environments with any issues. We use 11g Oracle Spatial. – Mapperz Jun 16 '14 at 13:46
1

"the error message gives information which should be undisclosed, such as passwords."

You mean that when you try and connect giving an invalid password, the error message that QGIS issues informing you about the connection failure shows the invalid password you just typed ? That is not really a security breach since you just entered that incorrect password. You need to be more specific and explain precisely what you observe.

Connecting to an Oracle database requires a username and password. Those (at least the password) should always be prompted from the user. That said, I have seen many client tools (not just GIS tools) that offer to remember the password you entered, so you don't have to reenter again later on. That is fine as long as the client stores that password in a safe way (i.e. not in clear text in a config file). If QGIS does that, then this is a serious bug that needs addressing.

"Also, I'm able to view databases I shouldn't have access too."

The data a user of the database can see depends on the rights that your DBA has given to that user. They can be restricted or wide open. In real life, that user should only have the rights that are strictly needed, i.e. the user only sees those tables that he/she is allowed to access: nothing else. If you see something different, then you need to take that up with your DBA and tell him to setup proper security.

The database has powerful capabilities. There are "system" user names such as SYSTEM or SYS. Your QGIS users must never connect using such a user name: those are strictly for use by the DBA only (just like the root password for Unix is only used by a system administrator). It is possible to give a user massive rights by granting it the dba role. That again is a big NO-NO. Only DBAs can use that right.

Finally, there is the MDSYS account, a "system" user for Oracle Spatial. Do not connect using that account (it is disabled by default). Never store any user data in that account!

All security-related questions I have seen with databases (not just Oracle) always came down to mis-configuration, mis-use, or lack of proper understanding of security rules.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.