Security

[Steve95]

Hi All

I have a report, which has a subscriber parameter. Their are many subscribers and each subscriber has a report runner (1 to 1 relationship)ie. the person who runs the report.

For confidentially reasons, a subscriber (runner) must not see any other name apart from his own in the parameter list. Does anyone know is this possibles, as this will save me making 100 copies and then thinking about the maintenance issues.

Iam using CRXi rel.1 and these reports will made available through BO's Infoview.

Many Thanks for your help

 

[Madawc]

To clarify, is it necessary to put the list in the parameter? Or could you just let them enter anything and treat it as an error if it was not a value on the list?

Madawc Williams (East Anglia, UK). Using Windows XP & Crystal 10

 

[Steve95]

If I let them enter a value they might enter another subscriber's name and view their information. Nice approach but this will be prone to a security lapse.

 

[Madawc]

What about an unguessable password?

Madawc Williams (East Anglia, UK). Using Windows XP & Crystal 10

 

[Steve95]

so have 2 parameters, a password to match a subscriber and if both correct display data?

is that what you suggesting?

 

[Madawc]

Something like that. I've never used such a system but it ought to work.

Madawc Williams (East Anglia, UK). Using Windows XP & Crystal 10

 

[Steve95]

Anyone else any ideas?

 

[IdoMillet]

Yes, the approach above should work.

- Ido

Visual CUT & DataLink Viewer:
view, e-mail, export, burst, distribute, and schedule Crystal Reports.

http://www.MilletSoftware.com

 

[rosemaryl]

Dear Apollo25,

Does the report runner for each location have a login and you can select data based only upon that login?

Depending upon the database, you can create a sql expression that returns the user id logged in to run the report, and then would need no parameters at all.

For example, in SQL Server the sql expression, using the system function listed, would be:

{fn USER()}

You would just need to check what the correct expression would be to return this information from your db.

regards,

ro

Rosemary Lieberman
rosemary-at-microflo.com,

http://www.microflo.com

Microflo provides expert consulting on MagicTSD and Crystal Reports.

You will get answers more quickly if you read this before posting: faq149-3762