11.6 SB Read Only Relationship to Startup-Check for Access to DBA Views

[chuckoneal99]

I have an account with select any dictionary/table along with insert/update/delete any table and alter any trigger(data correction account without complete DBA privs in a QA environment). In 11.6 the SB data grids are read only and I can't change it. I saw older posts directing uncheck "Startup-Check for Access to DBA Views". It did unmask the SB grid read only checkbox, but does other crazy stuff like hides all triggers. The same account in 11.5 did not enforce SB read-only and I'm able to leave Startup-Check for Access to DBA Views enabled. Also related, I started the 11.6 with elevated access on just 1 table and it did not respect the privs. The SB read-only is restricting the real access unless I'm missing something.



------------------------------------

Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/toad/

<*> Your email settings:
Individual Email | Traditional

<*> To change settings online go to:
http://groups.yahoo.com/group/toad/join
(Yahoo! ID required)

<*> To change settings via email:
toad-***@yahoogroups.com
toad-***@yahoogroups.com

<*> To unsubscribe from this group, send an email to:
toad-***@yahoogroups.com

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/

[John Dorlon]

Hi Chuck,

There was a change in 11.6 to make the grid read only if you are browsing tables in other schemas, and you don't have the update any table priv, and you don't have update privs on the selected table. There was a bug in the way we checked for the update priv on the given table, but it is fixed now in beta.

This is the first I've heard of unchecking 'check for access to dba views' as a solution to this problem, and also the first I've heard of it not detecting 'update any table'. Is that priv granted directly or through a role? If through a role, does a direct grant fix it?

The reason for the change is that some people would try to update the table, learn they don't have privs by way of an Oracle error, but since the grid did a 'select for update', a lock would be obtained on the row, and it would stay there, causing problems for others.

As a workaround, do a CTRL+E (E for 'Edit') on the table in the SB LHS and it will send an editable query on the table to the Editor.

-John



From: ***@yahoogroups.com [mailto:***@yahoogroups.com] On Behalf Of chuckoneal99
Sent: Wednesday, February 27, 2013 8:09 PM
To: ***@yahoogroups.com
Subject: [toad] 11.6 SB Read Only Relationship to Startup-Check for Access to DBA Views



I have an account with select any dictionary/table along with insert/update/delete any table and alter any trigger(data correction account without complete DBA privs in a QA environment). In 11.6 the SB data grids are read only and I can't change it. I saw older posts directing uncheck "Startup-Check for Access to DBA Views". It did unmask the SB grid read only checkbox, but does other crazy stuff like hides all triggers. The same account in 11.5 did not enforce SB read-only and I'm able to leave Startup-Check for Access to DBA Views enabled. Also related, I started the 11.6 with elevated access on just 1 table and it did not respect the privs. The SB read-only is restricting the real access unless I'm missing something.

[chuckoneal99]

Of course I can't repeat it now. I think the fact it is under "Startup" is what convinced me to restart my 11.6 app. I'm also having Oracle STIGs applied underneath me as I'm working so anything is possible. This is a complete list of the grants. BAIM.PARAGRAPH is the table I was editing. Thanks for the workaround.

-- 1 Role for RO_CONEAL
GRANT SELECT_CATALOG_ROLE TO RO_CONEAL;
ALTER USER RO_CONEAL DEFAULT ROLE ALL;
-- 9 System Privileges for RO_CONEAL
GRANT ALTER ANY TRIGGER TO RO_CONEAL;
GRANT ALTER SESSION TO RO_CONEAL;
GRANT CREATE SESSION TO RO_CONEAL;
GRANT DELETE ANY TABLE TO RO_CONEAL;
GRANT EXEMPT ACCESS POLICY TO RO_CONEAL;
GRANT INSERT ANY TABLE TO RO_CONEAL;
GRANT SELECT ANY DICTIONARY TO RO_CONEAL;
GRANT SELECT ANY TABLE TO RO_CONEAL;
GRANT UPDATE ANY TABLE TO RO_CONEAL;
-- 1 Object Privilege for RO_CONEAL
GRANT DELETE, INSERT, SELECT, UPDATE ON BAIM.PARAGRAPH TO RO_CONEAL;

Post by John Dorlon
Hi Chuck,
There was a change in 11.6 to make the grid read only if you are browsing tables in other schemas, and you don't have the update any table priv, and you don't have update privs on the selected table. There was a bug in the way we checked for the update priv on the given table, but it is fixed now in beta.
This is the first I've heard of unchecking 'check for access to dba views' as a solution to this problem, and also the first I've heard of it not detecting 'update any table'. Is that priv granted directly or through a role? If through a role, does a direct grant fix it?
The reason for the change is that some people would try to update the table, learn they don't have privs by way of an Oracle error, but since the grid did a 'select for update', a lock would be obtained on the row, and it would stay there, causing problems for others.
As a workaround, do a CTRL+E (E for 'Edit') on the table in the SB LHS and it will send an editable query on the table to the Editor.
-John
Sent: Wednesday, February 27, 2013 8:09 PM
Subject: [toad] 11.6 SB Read Only Relationship to Startup-Check for Access to DBA Views
I have an account with select any dictionary/table along with insert/update/delete any table and alter any trigger(data correction account without complete DBA privs in a QA environment). In 11.6 the SB data grids are read only and I can't change it. I saw older posts directing uncheck "Startup-Check for Access to DBA Views". It did unmask the SB grid read only checkbox, but does other crazy stuff like hides all triggers. The same account in 11.5 did not enforce SB read-only and I'm able to leave Startup-Check for Access to DBA Views enabled. Also related, I started the 11.6 with elevated access on just 1 table and it did not respect the privs. The SB read-only is restricting the real access unless I'm missing something.

------------------------------------

Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/toad/

<*> Your email settings:
Individual Email | Traditional

<*> To change settings online go to:
http://groups.yahoo.com/group/toad/join
(Yahoo! ID required)

<*> To change settings via email:
toad-***@yahoogroups.com
toad-***@yahoogroups.com

<*> To unsubscribe from this group, send an email to:
toad-***@yahoogroups.com

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/