Details
-
Type:
Improvement
-
Status:
Closed
-
Priority:
Minor
-
Resolution: Fixed
-
Affects Version/s: 1.9
-
Fix Version/s: 1.9.7
-
Component/s: Admin report: Custom SQL queries
-
Labels:None
-
Affected Branches:MOODLE_19_STABLE
-
Fixed Branches:MOODLE_19_STABLE
Description
Tim - Good work on the custom sql admin report. I was thinking that the Partners may find this helpful as an alternative to PHPMyAdmin (as mentioned in the forums). One thing that I think would improve things would be to require confirmation before defining (not necessarily for each execution) if there is risk of it modifying the database. I think anything with an UPDATE, EMPTY, DROP, or INSERT should be suspect. As a worse case scenario, I imagine someone reading on some blog that some DROP or EMPTY is a good idea and they add it without understanding what it does. At least a confirmation warning would alert an admin that they were creating a potentially dangerous and irreversible activity such that they should have a good backup of the database. Peace - Anthony
p.s. - I took the leading spaces out of the component name in the tracker so it is now alphabetical and set all issues to be assigned to the component lead (you) rather than the project lead (me). Thanks for covering the bases (tracker, CVS, download, M&P, and forum).
Did you look at the code, or try installing it and creating a malicious query? I thought I had made it impossible to define a query that altered the database.
However I was not aware of EMPTY, and I forgot TRUNCATE. I should probably add those to the bad words list.
Even so, it is probably safe, because get_records SQL appends LIMIT 5000 to the query, which breaks almost any update query.