Reviewed: November 2014
Versions effected: LDMS 9.5 and 9.6
Problem/ Scenarios:
You have different departments. 2 of 5 are already working with LDMS. Now, the admin of a third department is testing LDMS to decide if they want use LDMS.
Scenario 1
You have found a problem: The 3rd department can delete and edit every package which has not the 'Public User' as Owner in 'Public packages'. They have NO 'edit public' permissions, they just have 'edit'.
Scenario 2
The software engineer for LDMS creates packages in the team folder. He tests the packages and if the tests are OK, he moves them into 'Public packages'. When he moves the packages into public, the owner will not be set as 'Public User'.
The owner would not be the problem, the problem is that the permissions are in relation with the owner. So when the owner of a package is not 'Public User', every user with a simple 'edit' permission can do everything.
Firefox package with wrong Owner
Cause:
When moving packages from one folder to another the owner does not change and the permissions needed or associated with each package are derived by who the owner of the package is. So as described above if the package is moved from a team folder or a 'my' folder then the original owner will stay and the permissions associated with it as well.
Solution:
It is highly recommended that you change the owner and therefore the permissions of every package manually to 'public owner' to prevent the above problems. And then include the action of changing the owner from orginal owner to the public user in the process of testing and making the packages ready for deployment,
If you have a lot of packages with this issue already within the public packages folder you can run the following query on the LDMS database to fix the permissions on the packages and change the owners to 'Public user' quickly.
It is recommended that you make a backup of the database before applying this query as a per-cautionary step.
USE [name of LDMS DB]
-- Declare the variable to be used
DECLARE @PublicPackageidn int;
-- Initialize the variable.
SET @PublicPackageidn = (SELECT PACKAGE_IDN
FROM [PACKAGE] where NAME = 'Public packages');
WITH SubStruc(Parent, Child, Name) AS
( SELECT RELATIONSHIP_IDN AS Parent,
PACKAGE_IDN AS Child,
TYPE AS Name
FROM PACKAGE_RELATIONSHIPS AS T
WHERE T.RELATIONSHIP_IDN = 0 -- IDN of start
UNION ALL SELECT Parent,
Child,
TYPE AS Name
FROM SubStruc AS S
INNER JOIN PACKAGE_RELATIONSHIPS AS T ON S.Parent = T.PACKAGE_IDN-- going down inside the structure
)
update PACKAGE set ConsoleUser_Idn=(SELECT [ConsoleUser_Idn] FROM ConsoleUser WHERE UserName = 'Public User')
where PACKAGE_IDN in (SELECT Child FROM SubStruc)
Results below:
Owner corrected