Re: [cobalt-users] Re: phpMyAdmin multi-user

[Brent Sims <bs@xxxxxxxxxxx>]

On Thu, 30 Aug 2001, Jorge Otero wrote:

} I remember a customer/friend alerting me (a couple of weeks ago) that he
} could _see_ the names of all the databases. Only that he couldn't access
} them or change them.
}
} I guess this means I need to change some settings, but where?

Every installation of phpmyadmin that I've done, and I've done a few
hundred installations, could see all of the databases hosted on the
server. If those databases are properly configured (you didn't give
any of your MySQL users file privliges, did you?) and if the user
using a phpmyadmin installation does not have a password for any of
the other databases that user will only be able to view the database
names though.

	You can, however, set the 'only_db' variable in the
conf.ini.php3 script to the name of the only database you wish the
user to view. You could go so far as to create a seperate user/group
just for this purpose, install phpmyadmin under that user/group and
not give write permissions to the user in order to make things a bit
tougher but... never forget, that any user can install phpmyadmin
without you so they could see the databases if they so desire and
there's not much you can do to stop them...

	Peace be with you,

	Brent Sims
	WebOkay Internet Services, LLC
	http://www.WebOkay.net
	mailto: Brent@xxxxxxxxxxx
	(719) 595-1427 (Voice/Fax)