RE: security hole in interactive sql call statement?

[Patrick Botz <botz@xxxxxxxxxx>]

I just have to add my $0.02....

>Just a bit disappointed with this security hole in strsql.

This isn't a security hole in strsql. It is a security hole because you are
not using object level authority. There is no such thing as menu security.
Limited capabilities ONLY applies to green screen command lines. About 10
years ago (or longer) when we started supporting things like ODBC,
menu-based access control (we don't even call it meu security) only works
if you don't have anyway to access the system other than a green screen. If
you have servers like FTP, ODBC, etc. running, then you need object
authority on the data. Some will argue that exit point programs are
sufficient. I will agree that exit point programs are better than nothing
if you don't have the appropriate data-based access control configured.

Patrick Botz