1

I have set up an external database source using the Forena reports module and the PDO driver. This data source has its data security method set to "Use Drupal permissions". The only other option is "Match values provided by a data block".

There is a matching Drupal permission for the data source in admin/people/permissions labelled "Access MyDB data". (Machine name "access my_db data"). The "Access MyDB data" permission has only been granted to a couple of roles.

What I have tried: I put a line in my .sql file for the data blocks built on this source:

--ACCESS=access my_db data

This prevents anyone from getting any results from the report based on this data block, even the Drupal administrator.

I removed the above line in the .sql file. This allows any logged in user to access the report. It does not respect the permission "Access MyDB data".

How do I set this up so that the access to this data block (and therefore the reports using it) is limited to only those who have the "access my_db data" permission?

1

Quote from the documentation that comes with Forena, about Data Block Security:

Data Blocks Security is a technique used to secure a selected data block. It is an additional (but optional) security layer on top of the Drupal permission "access repository name data" right (whereas "repository name" is the name of the data block's repository). Using this technique it is possible to enforce additional Drupal permissions such as:

  • access content
  • access administration pages
  • administer content
  • administer users
  • administer permissions
  • ... (the (Drupal permissions) sky is the limit)

Data Blocks Security is actually implemented by means of a comment containing ACCESS=some_permission. It is added near the top of a data block which indicates the Drupal permission required to access the data retrieved by the data block. Its format depends on the format of the Data Block (which can be either in SQL format or in XML format), as further detailed below.

From the scenario in the question here, it appears to me that there is no need for adding such comment with ACCESS=some_permission, instead it should be sufficient to only use the access repository name data for those "couple of roles" that should have access to the data in the report.

Note the data in the report I wrote here: it is well possible that users who do not have the required permission for the data blocks, do have access to such "reports" anyhow. However: those reports, by design, do not show any data of the data blocks they do not have access to.

Nevertheless, I wonder if there is anything (like a bug?) that may be related to the "my_db" part of your issue. Therefor I'd recommend to also experiment with (eg) the "Drupal" reports: only grant access to these reports to "Admin" role, and then run a similar testcase. How do your results look like in that scenario? As a variation, can you (temporarily) rename "my_db" to "mydb", to check what results you then get?

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.