Hello Friends,

   I am developing a small ERP System in DNN but I had got some question after seeing this.. that any one can get host account role by having small knowledge of SQL. In user table if any one update IsSuperUser=true then particular user will get the all the rights which was given to host..

Thats it....

so any one can help me to avoid this thing??

Thank You

Regards

Boyzs

Hi Boyzs,

The key to application security is in preventing unauthorized users from making such a change.  The DotNetNuke framework already does an excellent job of this.  You can do your part by ensuring that your server is appropriately locked down and that your database is properly permissive.

I suggest reading over the guidelines located here to get started.

Hope this helps!

Brandon

Boyzs,

what is your idea? Storing the host assignment in roles would require to simple add an entry in userroles table - which does not make a difference. I am not aware of a technique, how to prevent security frauds by anyone, who has full access to your database. If an enemy inside your castle, there is no use of building the walls higher...