give the web user access to run xp_cmdshell

[mflancour]

I have a stored proc that uses xp_cmdshell. I have a web interface that we would like to use to call this proc. You can see the problem. Can really just give the web user access to run xp_cmdshell. Anyone know a workaround for this that wont compromise the database?

 

[AlexCuse]

What (specifically) are you using xp_cmdshell for in your proc?

I think you are right, that this is not a good idea to allow your web user to run it!

Ignorance of certain subjects is a great part of wisdom

 

[mflancour]

it's unzipping and moving files

 

[nice95gle]

Can scripting handle this better than xp_cmdshell for web users?

Well Done is better than well said
- Ben Franklin

 

[AlexCuse]

What version of SQL Server? If you have 2005, CLR might be an option for this, if you can't handle it from the front end app.

Hope this helps,

Alex


Ignorance of certain subjects is a great part of wisdom

 

[mflancour]

its' 2000 other thing cmdshell is doing is also /dir to get the list of files in a directory.

 

[AlexCuse]

Well, that eliminates CLR :-(

And where are these files? On the SQL server? The web server? Somewhere on your network?

Hope this helps,

Alex

Ignorance of certain subjects is a great part of wisdom

 

[Crowley16]

correct me if I'm wrong about this, but if you ONLY give users permission to run the wrapping sproc, then they can only run that, and not xp_cmdshell directly...

--------------------
Procrastinate Now!

 

[mflancour]

Can't really say, just scares me. I've been told there is a way to get directory information without using cmdshell. If someone can tell me how to do this I can get it to work.

 

[ptheriault]

Check out this thread.

thread183-1355242

- Paul

- If at first you don't succeed, find out if the loser gets anything.

 

[AlexCuse]

mflancour - I think it scares you for good reason. This really isn't a job for the database. If your web and network security are properly configured, you should be able to do this from your application (not from the database)

Hope this helps,

Alex

Ignorance of certain subjects is a great part of wisdom

 

[AlexCuse]

Crowley - that appears to be OS- dependent.

http://msdn2.microsoft.com/en-us/library/aa260689(SQL.80).aspx

(see 'remarks' section)

Hope it helps,

Alex


Ignorance of certain subjects is a great part of wisdom