Database / PHP security question

Question

Hello,

We are developing a very simple first stage GUI for a company database. At the moment our time to deliver is rather limited. So we thought about using a simple SQL stored procedure and retrieve all data. The data the users are allowed to see is depending on security levels defined in the database and also in our Active Directory. So after fetching all the data, the GUI displays only what the user has access to view / edit.

My question is if there are any remarkable security issues with this aproach? It should also be noted that both the webinterface and the database are located in our intranet.

Our backend uses W2K3, IIS, PHP 5, SQL 2005

Any feedback would be greatly appreciated

Jonas

Answer 1

Don't put an outward facing web server on your internal network. Seriously. Put it in a DMZ.

As far as your data is concerned, will you be filtering based on user access before or after the data hits the web front end? I'd suggest doing it in the proc.

Also, if you can, I'd suggest putting your DB on a separate box as well, for added security.

Answer 2

Considering the time to deliver (about 1month), it should be rather ok.

First thing: since it is in intranet only, your site should be rather secured since outside world cannot be accessing your site.

secondly, XSS and cross site request forgery should be disabled no matter what.

next, SQL injection.

with these few things in mind, the application should be basically secured.

Answer 3

It is a sound enough approach. This way the data the user is not allowed to see remains in the database.

Answer 4

"So after fetching all the data, the GUI displays only what the user has access to view / edit."

A frequent mistake when dealing with access control on websites is implementing them for the data fetching scenario but not the data writing scenario. This is often the result of the assumption "the user will only send us editing requests on resources that we told her she could edit". Unfortunately...

As I coudln't spot this in your question's content, I'd just recommend making sure you effectively dealt with access control when building the GUI but also when receiving data modification requests.

If we consider the following scenario:

1. The user fetches data she has legitimate access to.
2. The user requests edition of that said data. Let's imagine an edition form is now displayed.
3. The user submits the form with the changes.
4. Before leaving her machine, the user intercepts the HTTP request and replaces the identifier of the edited resource by another identifier, to which she shouldn't have access.

Does your model ensure that when receiving the editing request, the access control rules are also applied? From a SQL-like scenario, this would translate to asking whether you're using a request template such as the first one below or the second one below:

1) "UPDATE ... WHERE ID = x"

2) "UPDATE ... WHERE ID = x AND (SELECT ... FROM ... WHERE userID = y)"

If your model is more likely to be the first, then you might have an authorization model issue. Else, it should be okay.

Hope it helps.

sb.