Adding security to a wiki - mysql

My company wants to use a wiki for training, to try and encourage a team learning and teaching approach. It was easy enough to set up the wiki, but I am trying to find the best way to require a username/password that calls upon an existing users mysql database table.
Does anyone know how to connect a wiki to a mysql database table for user authentication?

Just use a wiki that already has that functionality. Like Banana Dance (shameless plug!):
http://www.doyoubananadance.com/
If you're stuck using what you currently have, you'll have to simply:
1. Set up a table for users within your MySQL database,
2. Create PHP that will allow users to register/login/edit their accounts.
But since your question is so vague, it's hard to really answer short of doing the programming work for you, which probably won't happen.

Related

Convert local database to cloud hosted mysql database

I have an application which is currently tied to the desktop application which will specific to each of my users.
The Existing application has about 300 table
The current database design is specific to a single user. For example , for a given clinic as user , we have following tables
• Patient
• Patient_address
• Patient_Images
• Employees
• Clinic_details
• Devices
What I want is to host this database on web. I want to use this database for multiple users and need to be able to store and retrieve data on a user unique key(Let’s say user ID)
The database will be local as well as cloud based i.e. I would like user to continue work even if they do not have internet, and be able to sync it on demand when connection is back, I may also choose to run a nightly sync process on user desktop.
What is the best strategy to do this? Currently I’m using MySQL, would it help if I switch to SQL?
Any help in this is appreciated.
Thanks
Bhim
P.S. - If this is not the right forum, please suggest the right forum for this question.
MySQL is SQL. You cannot switch from MySQL to SQL. It is like saying that you want to switch from Espresso to Coffee.
If you want the ability to work offline and sync when the connection is back, be prepared to be working on that little feature for the next couple of years or so. I would say, do not even try.
For storing all of your "users" in one database, the term you are looking for is multi-tenancy, and it is a big subject, not suitable for a stackoverflow question and answer. So, multi-tenancy is the term you want to google for in order to find information on how to achieve this.

Controlling access to data in MySQL, using Node, Express, Knex and Bookshelf

I am very new to database design and structuring - I have had no formal training and am purely self taught so I apologize in advance if this is a bland question.
I am designing a web app and am thinking to the future as users will have to be able to interact with each other sharing part of their data. I am wondering if there is a standard convention to controlling access to tables in MySQL and how I should generally tackle this problem with code written in NodeJS, ExpressJS, KnexJS, and BookshelfJS.
For example: a user will be matched with another user, both users will be able to see location, favourite book, etc but not able to see last name, birth date. etc.
How do I control this?
If anyone could point me to a few resources they have found helpful that would be great as well.
You seem to have learned a bit of MySQL and its access control features. Well, database user level access control IS NOT used by modern applications -- that could make resource management, like connection pools, very hard to implement. Usually SQL databases backing web applications have a single or, at most, two users: one for general data access and one for admin purposes.
The kind of access control you mentioned MUST be handled by your application code, YOUR code. There are libraries that help take care of authentication (e.g. passport) and authorization but ultimately it is YOUR CODE responsibility.
So my answer to your "How do I control this?" question is:
With YOUR code.
This is the whole point of Software Development.

Best Place to House the .Net ASPNETDB Membership and Roles DB

I am currently developing a business application that will ultimately be hosted at a .Net hosting company. The hosting company provides 1 MSSQL DB (with 2 users) and an unlimited number of MySQL DBs. Purchasing a second MSSQL DB is out of the question as my boss doesn't want to pay any more for the hosting. I am trying to determine the best place to house the ASPNETDB for site authentication and roles.
My first thought was to take advantage of one of the MySQL DBs for this purpose but have noticed that it appears to take some hoop jumping to accomplish this option. Another option may be to keep the ASPNETDB in a Express DB file.
Finally, I have also thought about housing it in the MSSQL DB with the application tables. This option scares me because if I accidentally screw something up in the application, the ASPNETDB tables could be open to SQL injection. Of course, I will do my best to ensure this won't happen anyway, but would like to know I have that extra layer of security knowing it is housed in its own DB.
The hosting company does allow two MSSQL DB users, so this in theory would allow me to have one user dedicated to authentication and restrict the other user from being able to access the ASPNETDB tables all together.
As a fellow developer, what method would you recommend? Thanks in advance for your help.
Use the MSSQL DB and use the preconfigured ASP.NET Membership provider and Roles provider. This is the easiest method. Restrict Table level access and use only Stored Procedures.
Sounds like you are a bit green to this stuff, am I correct? Because of that dont create too many headaches for your self. Dont try to put it in mysql, thats a mistake. I know its free, but it was written to work with MSSQL. Yes, using the other user is a good idea. Just be sure to sanitize your inputs and use properties on your SQL statements or better yet use an ORM like entity framework or Linq to SQL at the least.

Share logins between 2 databases or?

I have a personal website using a MySQL database (with justhost.com). The registration is very simple and only requres a username, pw, and email. I want to add an Oekaki to my site, but the Oekaki install instructions say it should have its own database. If I input the database I am currently using, will that screw it up, or will it create a new table within that database so when a member logs in, they have access to the Wiki and Oekaki under the same username and pw?
Please note I am a database newbie. I am using TikiWiki 6.2 currently and at its initial install of TikiWiki 5 created its own database. If the above won't work in any way, after I create a new database for the Oekaki, what would I have to do so it uses the current registration information from my TikiWiki database without me having to manually enter in every single user one by one for the Oekaki side of the site?
Any information is helpful, even if it just helps me learn a little bit more about databases. :)
I don't know any of these software you mentioned. But i can say in general if a software itsself recommends to use one single database for it you should do it.
I had a similar problem with my wordpress blogs database and another organisational software i installed. The next day all my blogs content was gone forever.
It could be, that for example the software just throws all existing tables away.
So my answer (or better advice) is. Be careful and if you can avoid it, don't throw together two applications in one database.
For the user-table thing you could probably just change one of the systems to use only the user-table of the other system. So nothing will be screwed up. Or if you have the opportunity make a third "General" Database where you just put your users data and use it in both systems.

Teach an M.B.A. the intricacies of Microsoft SQL Server (and how's it different from MySQL?) [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about programming within the scope defined in the help center.
Closed 9 years ago.
Improve this question
I haven't had to interact w/MSSQL much in my development career, though I've spent many an hour working with MySQL.
An M.B.A. friend of mine is starting a job where she needs to gain functional knowledge of MSSQL Server, and I'd really like to help.
What are the differences between MSSQL and MySQL?
How would you recommend a non-technical person go about learning the ups and downs of MSSQL Server?
[update] Previous database design skills are naught. I've given her to short and long on what a database does from a high-level.
I'd love to say, "you can't". But that would be untrue (or at least mean).
If she has any background with database design at all, then this is merely a new RDBMS.
If she's never done database design, the place to start is not so much with MS SQL, but with how databases work, in my opinion.
Database Design for Mere Mortals is a good place to start. From there I'd move to an MS SQL -specific book, such as Microsoft SQL Server Unleashed.
Download the free SQL Express and start using it. Microsoft also has several video tutorials that would be helpful. They start pretty much from the beginning with "What is a database" and move to more advanced topics.
From the perspective of the database user, the backend is generally irrelevant if they understand some basic concepts.
First and most important concept for the non-technical user is GIGO (Garbage in Garbage out). Bad data is useless data. Check everything you enter into a database for correctness. You really don't want the customer's product to be mailed to San Diego, VA instead of CA.
Then next most important thing is to really understand your user interface and how it works. I've spent a lot of time fixing up junk because users didn't know what they were supposed to put in fields in databases (it would have helped if the developers had not allowed non-email type data to be entered into the email field, but you can't send an email to 757-111-6789). It is never a good idea to put the wrong kind of data into a field because you don't have another place to put it. As a user, you may have no idea what the database is going to use that data for and wrong data can completely stop a process or break something really important. If you don't know what to put in a field, then ask. Don't put junk into a field just because it is required. (Hint, it is required for a reason, that usually means this is data critical to the operation of the database, do not fake this information.)
Now if this person is doing reporting, then the critical concepts become understanding boolean algebra and a very strong undertanding of joins. If you have these two concepts down pat, you have 80-90% of what you need to query a database.
The specifics of the database supported also become important. You need to understand what is stored in what tables (or what views to use) and how they relate to each other. Coming into a new job, I would sit down with the developers if possible and get an overview of the design and whatI would need to know to get the data. I would review existing report queries to see how the data is currently being retrieved and use that to ask questions if I don't understand what the person did. Even a database expert will need to spend some time doing this when faced with a new database, so there is no reason to be shy in asking these questions when you are new.
Final thing is to learn how to report a problem to the developers. Problems that are not reported don't get fixed! Problems that are not reproducable because the user didn't provide screen shots and a context for what she was doing when the error occurred, don't get fixed either. New data fields that are needed as business requirements change, don't get added to the database until the developers know about them (Please ask for a Notes field if you need it instead of entering junk data into a field like email that you personally are not using for instance). New business requirements often require a lot of work in the backend to change how things work, it isn't as simple as adding a field on a form. Please be aware of that too when you make requests.
I learned from Robert Vieira's Professional SQL Server 2000 Programming -- well written and comprehensive. I am pretty sure the 2005 version is very similar, just updated. Despite the 'professional' label, I found it a great intro (I had practically no database experience at the time).
Also I second Erikk's comment. Download SQL Express and PLAY!