Sqlyog Showing All Database On Webhost!

[GreenAlien]

Something odd has happened. I don't think this is a SQLyog issue, but more of a webhost issue, but I'll mention it here in case anyone else has experienced this.

I connected to my mysql database on my webhosting account, and noticed loads of databases listed! Now because all database names are prefixed by the account name, it's fair to say that it's listing all the databases for all the customers that are using the same physical server.

Is SQLyog's HTTP tunneler too clever for its own good, or is this a security issue on the server? (I think it's the latter).

A few days ago I was doing exactly the same thing as I was doing tonight, and definately only saw my own databases on that occasion. So this is something that has cropped up during the last few days.

Bit annoying because I now have to scroll through a long list of databases to locate my own when connecting up and using the sync tool too.

I can't see the structure/data for anyone else's database – only the database names (loads of them). So not a critical security/privacy issue as such.

I've emailed the webhost. Anyone else experienced this before?

Cheers, Ant

[peterlaursen]

It does not occur here and I have the same prefixing

like “domainusername_databasename”

and also use HTTP-tunnelling.

[Ritesh]

What is the MySQL version you are connecting too?

Prior to v4.0x, it will list all the databases when

Code:

show databases

is executed. After that, only the databases that you have to access to will be displayed.

You can specify which database needs to be added to Object Browser by specifying them in Database(s) field in the connection window.

[GreenAlien]

Ritesh wrote on Aug 26 2005, 05:04 AM:

What is the MySQL version you are connecting too?

Prior to v4.0x, it will list all the databases when

Code:

show databases

is executed. After that, only the databases that you have to access to will be displayed.

You can specify which database needs to be added to Object Browser by specifying them in Database(s) field in the connection window.

[post=”6984″]<{POST_SNAPBACK}>[/post]

The version of mysql that my webhost is currenty using is 4.0.25 according to phpmyadmin. I just had a look at a backup (sql dump) I made one week ago, at a time when I definately did not see this issue, and the header says version 4.0.24. So it looks like my webhost has upgraded/patched mysql since it was last working correctly. Either 4.0.25 has introduced a bug or something mucked up the config/security on their server. Another possibility is that SQLyog doesnt behave (or vice versa) with 4.0.25 but I doubt that because I don't see how any php code in SQLyog's HTTP tunneler file could expose all other customer's databases.

Anyway, I've reported it to my webhost and now it's up to them to fix it. As I write this post the problem is still there.

I have specified the database in the connection now, so that'll save me having to scroll through a zillion databases now. Thanks for the tip.

Can I make a feature request (assuming it's possible to implement):- Can I use a wild card in the database name? My webhost prefixes every database name with the account name, so it would be very handy to specify “accname_*” for the database and have just these databases listed. Eg “accname_blah1” and “accname_blah2” would get shown within SQLyog. I can imagine this being useful in other situations too.

Rgds, Ant

[Ritesh]

I have added it in the TO-DO list but I cannot guarantee the exact version which will have this feature.

[Ritesh]

BTW, did you you check out: Webyog Community Blogs

[peterlaursen]

Quote:

Can I make a feature request (assuming it's possible to implement):- Can I use a wild card in the database name? My webhost prefixes every database name with the account name, so it would be very handy to specify “accname_*” for the database and have just these databases listed. I can imagine this being useful in other situations too.

I think it is a pretty good idea – except for that I'd prefer SQL wildcards (% and _) instead of windows wildcards. Also then a “literal wildcard” should be escaped as according to MySQL escaping standard. domaninuser_database must then be entered as 'domainuser_database' and domainuser_backsash should be entered as 'domainuser_backs\ash' or even maybe 'domainuser_backs\\ash' (there is double escaping in a LIKE-clause). Just in case that the wildcard is used as a litteral.

I thought you had chosen only some databases form the connection dialogue!

BTW I have several versions of MySQL servers here. One is 4.0.25 and it is not a problem with the server as such!

[GreenAlien]

peterlaursen wrote on Aug 26 2005, 03:28 PM:

I think it is a pretty good idea – except for that I'd prefer SQL wildcards (% and _) instead of windows wildcards.  Also then a “literal wildcard” should be escaped as according to MySQL escaping standard.  domaninuser_database must then be entered as 'domainuser_database' and domainuser_backsash should be entered as 'domainuser_backs\ash' or even maybe 'domainuser_backs\\ash' (there is double escaping in a LIKE-clause).  Just in case that the wildcard is used as a litteral.

I think vastly more windows/unix/mac users know about (and at least are more comfortable with) the * and ? wildcards compared with sql wildcards.

Also, and more importantly, * and ? are more suitable because they can't appear in database/table names, where as SQL wildcards can and often do. Given that mysql database/table names are reflected in the name of the files they reside in on the server, it makes sense to use the same wildcard convention that filenames use. Otherwise people would be escaping characters all over the place and this would add unneccessary confusion.

peterlaursen wrote on Aug 26 2005, 03:28 PM:

I thought you had chosen only some databases form the connection dialogue!

No, had no need before this issue. Was working nicely a few days ago.

peterlaursen wrote on Aug 26 2005, 03:28 PM:

BTW I have several versions of MySQL servers here.  One is 4.0.25 and it is not a problem with the server as such!

[post=”7010″]<{POST_SNAPBACK}>[/post]

Thanks. So looks like a config issue then.

Rgds, Ant

[Author]

Posts