Re: AW: Can I create an ALWUPD/ALWDLT *No file with embeded SQL?

<snip>
But defining the file with SQL doesn't entirely prevent someone from
being able to alter the contents if they really are determined.
<snip>

Yes. Yes I know.
That is one of the aspects that hold us back of using it in any highrisk
application.
Still SQL was an option to do this.

For the CopyFile trick we know that we cannot avoid everything.
We have applied checks that at least make it detectable that things are done
outside our own processing and we signal/inform ourselves.
Contracts than must give the legal base to counteract things.

Regards,
Eduard.

----- Original Message ----
From: "Matt.Haas@xxxxxxxxxxx" <Matt.Haas@xxxxxxxxxxx>
To: rpg400-l@xxxxxxxxxxxx
Sent: Wednesday, May 30, 2007 12:43:17 PM
Subject: RE: AW: Can I create an ALWUPD/ALWDLT *No file with embeded SQL?


<snip>
- Source can be changed (we do not use any scripting language either)
and that is far to risky.
<snip>

But defining the file with SQL doesn't entirely prevent someone from
being able to alter the contents if they really are determined (also,
you can create a source file in QTEMP which will go away once you are
done). You can use CPYF to create a new file with the same name and
field attributes and use it to replace the file you created with SQL.
The new file would then be changeable. Can user programs write to the
audit logs? That would seem to be the best way to do this. Alternately,
you could create the file on your system, put it in a save file, and
restore it on the client's system.

Matt