Thread

1. mikestew · 1790117337 · focus · HN ↗

   Here’s my problem with reviving FoxPro in any form: there’s a huge security hole in the Database Container (DBC) design. For DBCs to be useful, they must be read/write to all users (there is no permissions scheme). DBCs have stored procedures that can run any FoxPro code, including Win32 calls made from the FoxPro runtime. The stored procedures are stored as plain text in a “memo” field. Do you see where this is going? With a little technical knowledge, one can modify that INSERT trigger to whatever you like. EDIT: as the DB is just files in the file system, modifications can be made using a text editor, bypassing any checks in the FoxPro runtime. FoxPro just executes what it finds in there.

   My recommendation is to get rid of the DBF/DBC files and move to a SQL DB of some flavor ASAP. If you have the source code, use ODBC or OLE DB to point to a server.

   Source: filed that bug over 20 years ago when I worked on the Fox team. No, it wasn’t going to get fixed without rewriting large parts of how the DB engine worked.

   1. SigmundA · 1790130836 · focus · HN ↗

      I have memories of supporting a Netware network with a custom Foxpro app used by a bunch of telemarketers in the mid 90's.

      When there was application error the source code would pop up in dialog maybe a some sort of debugger and the end users would just type a bunch of crap in trying to get out of it and hit enter and save the changes and corrupt the app for everyone and it would have to be restored from backup.

      Pretty sure it was Foxpro or maybe dbase, definitely wasn't MS Access as it was still a dos based client.

      Very different idea about app security back then, was really nice to developed the db, GUI front end and printable reports all in single runtime though.

Unofficial Hacker News client; not affiliated with Y Combinator.