Re: validation list usage scenario

On Wed, Aug 22, 2018 at 1:12 PM, Tim Fathers <X700-IX2J@xxxxxxxxxxx> wrote:

I'm still not convinced you're approaching this the right way, but I don't
think the QSYGETPH requires a password if the requester has *USE rights to
the profile who's handle is being retrieved, from the manual:

"

You could wrap the switching functionality up in a program with
USER(*OWNER) and have the owning profile have *USE rights to the user's
user profiles and then restrict access to this program to just the profile
under which the PHP job will run in order to stop it being abused. I don't
think it's particularly safe, but it might work.
-------------------------------


It would also enable any PHP script on the system, running as user profile
QTMHHTTP, to call that USER(*OWNER) program and switch to another user
profile.