可以用视图绕过拒绝读取权限吗？
考虑用户被拒绝访问财务机密表：
SELECT * FROM Transactions
SELECT permission denied on object 'Transactions'
没问题：
CREATE VIEW dbo.Transactions2 AS SELECT * FROM Transactions
Command(s) completed succesfully.
SELECT * FROM Transactions2
(84,387,982 row(s) affected)
用户是否应该能够通过为表添加别名来绕过表的deny 权限？
编辑：酱料： 
Consider user is denied access to a table of financial secrets:
SELECT * FROM Transactions
SELECT permission denied on object 'Transactions'
No problem:
CREATE VIEW dbo.Transactions2 AS SELECT * FROM Transactions
Command(s) completed succesfully.
SELECT * FROM Transactions2
(84,387,982 row(s) affected)
Are users supposed to be able to bypass deny permissions on a table by aliasing the table?
Edit: Sauce:
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这正如宣传的那样工作
它被称为“所有权链”
如果您不想让别人看到列/表，视图/函数/存储过程中没有它。或者添加逻辑/连接以根据您使用的任何模型检查权限。
以前的答案：一个，< a href="https://stackoverflow.com/questions/3633012/how-to-deny-delete-on-a-table-for-all-users/3642473#3642473">两个
它是在SQL中Server 和 Sybase 已经很久了。
This is working as advertised
It's called "ownership chaining"
If you don't want someone to see a column/table, don't have it in the view/function/stored proc. Or add logic/joins to check permissions according to whatever model you've used.
Previous answers: one, two
It's been in SQL Server and Sybase since, well, long time.
这难道不是视图意图的一部分吗？当用户没有对基础表的选择权限时，要启用对表中某些特定信息的可见性吗？
听起来这里的问题是相关用户首先有权创建视图。
例如，假设您想公开该表中的非机密信息；您可以通过将结果限制为您希望看到的内容来做到这一点。
Isn't this part of the intent of views in the first place? To enable visibility to certain, specific information from tables when the user does not otherwise have select permissions on the underlying table(s)?
Sounds like the problem here is that the user in question has rights to create a view in the first place.
For example, say you wanted to expose the non-confidential information in that table; you could do that with a view that limits the results only to what you wanted to be seen.