Database Reference
In-Depth Information
Figure 23.6
Add the Schema
Name to the Table
Name when
Querying Tables
You Do Not Own.
Test the ability of ARIEL to query the ARTIST table in the MUSIC
schema by executing a query while logged in as ARIEL. The result of this
query is shown in Figure 23.6.
SELECT NAME, COUNTRY, EMAIL FROM MUSIC.ARTIST
ORDER BY 1;
Now we could query the SONG table, which ARIEL has no privileges
to view, still logged in as ARIEL.
SELECT TITLE, RECORDING_DATE FROM MUSIC.SONG
ORDER BY 1;
Figure 23.7 shows the result. Oracle Database 10
g
tells us the table does
not exist! This may seem confusing, but it is intended to prevent hackers
from trying to find tables in the database. If Oracle Database 10
g
gave the
unauthorized user even a hint that he had found the name and schema of a
table, but simply did not have access to it, that could give the user enough
information to continue attempting to access the table. The deliberately
vague message discourages snooping.
