Re: QTEMP in LIBL (Was Re: OVRDBF problem or maybe itisearly Alzheimer's

["Gregg Willow" <gregg.willow@xxxxxxxxxxxxxx>]

At previous job sites, QTEMP always seemed to be the norm at the top of the 
list. However, at this site, they have it at the bottom. When asked why I 
was referred to this little article at Midrange...

Proper Use of QTEMP



Hey, Ted:

In the article, "Suggestions for a Temporary Library," the author writes the 
following statement: "...the top of the library list. QTEMP is already 
there."

So many sites put QTEMP at the top of the library list to save qualifying 
file names with QTEMP. I have always felt that this exposes a potential 
security risk. This is mainly for reasons that might never happen, but, if 
damage can be done, some day it is bound to happen. For example, a user 
using Query/400 could easily create a file in QTEMP that has the same name 
as a file elsewhere in the library list. A subsequent program might 
reference the file in QTEMP rather than the one it should. Subsequent 
scenarios range from a harmless program crash to accidental or even 
deliberate file corruption.

To get around this, I suggest that QTEMP should ALWAYS be placed at the 
bottom of the library list and that references to files in QTEMP should 
ALWAYS be hard coded.

FWIW,

Gregg


----- Original Message ----- 
From: "Holden Tommy" <Tommy.Holden@xxxxxxxxxxxxxxxxx>
To: "Websphere Development Studio Client for iSeries" <wdsci-l@xxxxxxxxxxxx>
Sent: Wednesday, July 12, 2006 2:42 PM
Subject: Re: [WDSCI-L] QTEMP in LIBL (Was Re: OVRDBF problem or maybe 
itisearly Alzheimer's


> Ummm...
> They can only place a rogue object in their current job's QTEMP....so
> how is that a security risk...you'll STILL know who did what...
>
>
> Thanks,
> Tommy Holden
>
>
> -----Original Message-----
> From: wdsci-l-bounces@xxxxxxxxxxxx [mailto:wdsci-l-bounces@xxxxxxxxxxxx]
> On Behalf Of Alan G. Campin
> Sent: Wednesday, July 12, 2006 2:27 PM
> To: wdsci-l@xxxxxxxxxxxx
> Subject: [WDSCI-L] QTEMP in LIBL (Was Re: OVRDBF problem or maybe it
> isearly Alzheimer's
>
> > > This brings up a question I have wondered about.
>
> > > I also always thought that QTEMP should be at the top of the user
> portion
> > > of the library list.  What is the logic for placing it at the end of
> the
> > > list instead of the beginning?
>
> I suspect this discussion should be in Midrange-L but here goes.
>
> I always thought that it should be at the top too until recently
> discussing issue with my boss and he brought up point that having at the
> top introduces security risks. Someone can place a rogue object in the
> QTEMP and it gets found instead of the real object.
>
> The solution is to keep the QTEMP in the bottom of the list and to
> always reference the QTEMP explicitly.
>
>
>
> --
> This is the Websphere Development Studio Client for iSeries  (WDSCI-L)
> mailing list
> To post a message email: WDSCI-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/wdsci-l
> or email: WDSCI-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/wdsci-l.
>
> --
> This is the Websphere Development Studio Client for iSeries  (WDSCI-L) 
> mailing list
> To post a message email: WDSCI-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/wdsci-l
> or email: WDSCI-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/wdsci-l.