Security Hole

December 6, 200124 yr

If I type this command into my browser address bar I get a full list of all

the databases I am serving on the website

fmpro?-dbnames=&-format=-dso_xml

If I type this command into my browser address bar I get a complete listing

of every field name and all the data stored in the database .

FMPro?-db=database.fp5&-format=-dso_xml&-max=all&-Findall

I am even able to change the command to this

FMPro?-db=database.fp5&-format=-dso_xml&-RecId=34319&-Delete

and delete the record.

Are there any Filemaker Web Security documents out there?

How can I prevent this from happing?

Many Thanks In Advance

December 6, 200124 yr

The listing of database names and feld names is a known issue -- many db system so this to enable ODBC (and other stuff) to work. Allowing other people to find out file and field names shouldn't be a security risk -- unless your main strategy is stealth of course! Stealth is never a good strategy by itself.

The -delete is only possible because the database either has no password security or you are already logged-in with a password that allows delete privileges.

December 7, 200124 yr

RE: The listing of database names and feld names is a known issue -- many db system so this to enable ODBC (and other stuff) to work. Allowing other people to find out file and field names shouldn't be a security risk

----------------

That is not so bad.

Bad is, that anyone can display all complete data from every database which is served to web. It is without formatting in "raw" form and all I can say is that FileMaker Inc. did very lousy security job with this non-existent protection.

Hopefully our server guy is working on solution for us. He successfully blocked that part, but with his filter running we cannot (yet) post any data to our databases from browsers.