1 2 3 Previous Next 43 Replies Latest reply on Dec 22, 2015 2:46 PM by disabled_JackRodgers

    Global variables $$ - is it "safe' to use ?

    simple

      I used lots of global variables in our company databases. Recently I read some articles warning against using global variables. Main reason is the values can be easily altered if you have a copy of FMPro Advance. Instead , people suggested to use global fields. I am getting very worry. Is this true?

        • 1. Re: Global variables $$ - is it "safe' to use ?
          user19752

          Using data viewer in Advanced, you can easily edit the value.

           

          For avoiding that, instant thinking for workaround.

          Use opening script, check the access privilege and application that Advanced can't open the file without full access.

          • 2. Re: Global variables $$ - is it "safe' to use ?
            TorstenBernhard

            if someone gained unauthorized access to your database, the problem may be of greater scope than just altered $$ variables.

            MAke sure that no one from outside can connect to the database. If external access is necessary, limit the scope and impose restrictions in the start script (i.e. forbid FMA client connections). The same applies to internal connections (see user19752's comment). Log all connections, also the attempts. Such a log privides transparency and lets you know who acessed or tried to access the database. Log IP, time, application, system data etc.

            • 3. Re: Global variables $$ - is it "safe' to use ?
              Markus Schneider

              we are using $$Var a lot, this method is solid.

               

              with full access to a database, one can alter everything - global fields, $$, etc, doesn't even need an advanced version (although with adv, one can get the $/$$ via dataviewer)

               

              the main problem could be, that You don't declare those variables, don't reset their values. This can lead to wrong content of a var. We declare the var's as much as needed/possible. As an example, when a script will use a var named $$MyVar, we define that var at the top of the script (or the caller script, etc) to "". Also a 'good' naming concept of the var will be helpfull

               

              -> make sure that the variable $$MyVar has the value that You expect and not some older values set by another script, etc.

              • 4. Re: Global variables $$ - is it "safe' to use ?
                Benjamin Fehr

                In terms of functional behavior, there seem to be no argument against global variables.

                Let's talk about performance: Most of my scripts run faster with Variables than with values set into any global fields.

                any thoughts?

                • 5. Re: Global variables $$ - is it "safe' to use ?
                  CarlSchwarz

                  It's fine except that if you use the same name twice, or another developer uses that name then it will get overwritten.  That's my worry when I work on someone else's file since I can't see what $$variables are being used until a script is called that creates it... or if I go to the effort of creating a DDR.

                  Out of habit I use globals and create a "globals" table if I need.

                  • 6. Re: Global variables $$ - is it "safe' to use ?
                    Fred(CH)

                    simple a écrit:

                    Main reason is the values can be easily altered if you have a copy of FMPro Advance. Instead , people suggested to use global fields. I am getting very worry. Is this true?

                    This one have no sense to me : this ability is only true with [All Access] accounts. If one have this access he/she also have ability to alter global fields within a layout.

                     

                    And keep in mind that globals are not to be considered real data, since each session handle its own values.

                     

                    Could you post a link to the article you are referring to ?

                    • 7. Re: Global variables $$ - is it "safe' to use ?
                      arnoldkegebein

                      Running the script on the client computer, using (global) variables might reduce network traffic.

                       

                      • Variables (global and local) are stored on the client computer.
                      • Fields are stored on the server.
                      • Scripts are usually run on the client computer.
                      • 8. Re: Global variables $$ - is it "safe' to use ?
                        Benjamin Fehr

                        Fred(CH) I agree. The User / Customers should never have [FullAccess].

                        But with [All Access], user is able to open Script Debugger and Data Monitoring Window. He's also prompted to enter [FullAccess] Account Name AND Password in order to see data and work the script debugger. Though it's useless.

                        You may ask yourself why FMPA is showing Debugger AND Monitoring option when user is not in [FullAccess] state and therefor not allowed to use it

                        • 9. Re: Global variables $$ - is it "safe' to use ?
                          arnoldkegebein

                          Proper documentation (and naming convention) is key.

                           

                          I use a script to initialize all global variables,. The script is called when the database starts or the user does a re-login.

                          The script also doubles as a documentation. Because every global variable is placed here, you can add comments to describe the purpose of this variable. A second developer can check here if the name of a variable is already used.

                          • 10. Re: Global variables $$ - is it "safe' to use ?
                            user14047

                            Even if there are no right of [Full Access] if global variable name is known,

                            it's possible to change it by a data viewer [Watch].

                             

                            Let ( $$globalVariableName = "Dummy" ; "" )
                            
                            • 11. Re: Global variables $$ - is it "safe' to use ?
                              Fred(CH)

                              Fred(CH) I agree. The User / Customers should never have [FullAccess].

                              It is not what i was meaning. Sorry to my language problems . And also to have talked about [All Access] instead of [Full Access]

                               

                              What i would like to point out is the fact that if you have access to alter global variables within Data Viewer, you also have access to global fields within a Layout.

                               

                              Thus, i meant that the *solution* was not definitely better than the *problem*. And one more time i am just curious about these *articles*.

                              • 12. Re: Global variables $$ - is it "safe' to use ?
                                IanJempson

                                Actually that's incorrect. A user who does not have [Full Access] privileges is able to see and edit any global variables in a solution provided they're running FileMaker Pro Advanced 12 or 13.  This behaviour is a bug and was fixed in version 14.

                                Fred(CH) wrote:

                                 

                                simple a écrit:

                                Main reason is the values can be easily altered if you have a copy of FMPro Advance. Instead , people suggested to use global fields. I am getting very worry. Is this true?

                                This one have no sense to me : this ability is only true with [All Access] accounts. If one have this access he/she also have ability to alter global fields within a layout.

                                 

                                • 13. Re: Global variables $$ - is it "safe' to use ?
                                  Fred(CH)

                                  You are right : i didn't think about this case. So yes, i suppose yes we can say that global variables are more vulnerable from this point of vue.

                                  • 14. Re: Global variables $$ - is it "safe' to use ?
                                    Fred(CH)

                                    Thank you, i was not aware of this bug but i cannot replicate this behavior with 13.0.5 nor 12.0.5 !

                                    What are the exact steps to take ?

                                     

                                    IanJempson a écrit:

                                     

                                    Actually that's incorrect. A user who does not have [Full Access] privileges is able to see and edit any global variables in a solution provided they're running FileMaker Pro Advanced 12 or 13.  This behaviour is a bug and was fixed in version 14.

                                    Fred(CH) wrote:

                                     

                                    simple a écrit:

                                    Main reason is the values can be easily altered if you have a copy of FMPro Advance. Instead , people suggested to use global fields. I am getting very worry. Is this true?

                                    This one have no sense to me : this ability is only true with [All Access] accounts. If one have this access he/she also have ability to alter global fields within a layout.

                                     

                                    1 2 3 Previous Next