Unlock a world of possibilities! Login now and discover the exclusive benefits awaiting you.
Hi all!
I have noticed a very strange thing using QVD files... Inside the file, I can read in plain text my QlikView script, including the connection string with password!
How it can be possible?
Hi there,
I use QV 10 SR3, and when I open QVD file I found all my script and the password in plain text.
A few days ago I installed the version QV 11 RC and after I removed it and reinstalled QV 10 SR3, can this make me this problem?
Regards
Luca Jonathan Panetta
I just tried it and I am speechless. I cannot believe such a disaster, this is very serious, I hope QT comes with a patch right away.
Nice discovery Luca.
Regards
In every headache there is a blessing ~ I just used this to get back some "lost" credentials from a scrambled connection string that were never documented. For clarification, if there cred's are scrambled in your script, they are stored unscrambled in the qvd header.
One more reason not to keep fighting integrated authentication I suppose 😃
Thanks, good to know!
I found also an unscrambled password (was scrambled in the script) at the end of the QVW created with QV10 SR3 in the xml metadata part:
<LineageInfo>
<Discriminator>...
This is an unbelievable risky major bug!
- Ralf
Wow! We have the same issue in QV10SR3. This doesn't thrill our SA's at all. Good thing our QVD's are locked down.
We had a good chuckle from Isiah Weed's post. Always a positive somewhere!!!!
This seems to be fixed in QV10 SR4. I cannot reproduce it.
- Ralf
Sorry Ralf,
I have try my test file with QV 10 SR4 9274 but the problem subsist.
I tried it with QV 9 SR7 7778 and it's all ok.
My script is:
OLEDB CONNECT TO .... //Connection String
CustomerSellers:
LOAD *;
SQL SELECT top 1 c.CardCode FROM OCRD c;
DISCONNECT;
X:
load * Inline
[x,y
1,2];
STORE * from X into X.qvd;
EXIT Script;
Regards
Luca Jonathan Panetta
I created a new QVW which stores some QVD files with QV10 SR4. It still stores the connect string but without the password.
So, I think this is not a problem anymore but of course maybe with old files ..
- Ralf
Ok Ralf,
I tried too and the Password there isn't but why I have my script and my connection string in a QVD if I want only to save the data of my table?
In QV 9 SR7 7778 I have only my data.
I wrote to the support too.
Regards
Luca Jonathan Panetta
It´s a knowed bug in 10SR2 and 10SR3
Fixed on 10SR4