FileMaker 11 is here! Are you ready for the next generation of the world’s most widely used, easy-to-use database?

As Platinum members of the FileMaker Business Alliance and long-term beta testers with FileMaker, we’ve been testing the new version of FileMaker for a while now and wanted to share some of what we’ve learned.

We’re extremely pleased to report that FileMaker 11 makes some core improvements for the user experience and these are what we’re going to focus on in this article. There’s a bunch of under-the-hood improvements that developers benefit from, but for now, we’ll focus on improvements for users.

There are many cases where FileMaker's scripting isn't always the best tool for the job and where a language like Ruby can bring a lot of power to your FileMaker development. The following is a description of a simple technique for using ruby scripts from within a FileMaker solution without the use of a plugin. I've found this technique useful for employing regular expressions for complex text parsing, making web requests to work with web APIs, and for parsing and generating XML and other serialized data structures. Ruby has a wealth of great libraries for doing anything you can imagine and is just plain fun to write.

A new version of our free FileMaker plug-in is now available. You can download the latest version at http://www.beezwax.net/download/bbox.

 

Changes in this version include:

• New functions for directly compiling and executing Python scripts
• Fix for character encoding issue with Euro character in the bBox_PasteboardGet function
• Fix for Unicode BOM issue on PowerPC based systems

Features already included in bBox since version 0.3d:

• execute shell scripts, with the output returned as the function’s result
• execute AppleScripts within a calculation, with parameters and the return value as the function’s result
• get or set raw clipboard (pasteboard) data
• filter text through grep, the powerful pattern matching command
• return the current time with milliseconds
• sort lines of text (optionally allowing you to specify a column or character range)
• find out what types of data are currently in the clipboard
• get a file path’s attributes, including type (file or directory), creation date, and POSIX permissions

 

The Problem

Most FileMaker Server setups on OSX that I have seen are using the default permissions as set by the FMS installer. When viewed in the Terminal, they look like this:

drwxrwxr-x  11 fmserver  fmsadmin   374 Jul 16 12:54 Databases

These permissions say that the fmsserver user and the fmsadmin group both have read, write, and execute permissions to the folder and it’s contents. So far, so good. But who's getting those read and execute permissions? Why, EVERYONE does! Although there can easily be exceptions depending on a server’s configuration, it's likely this means that any user with shell/SSH, SFTP, ARD (Apple Remote Desktop), or VNC access will have read access to all your live database files and their backups.

This issue also pops up if you copy a new database file into your database directory. An all too common mistake is to forget to set the file so that either the fmserver account or the fmsadmin group has write access to it. With the Upload feature now found in FMS 9 Admin console this is not as big a problem as it used to be, but there are still occasions where its desirable to copy a file directly to the database folder.

The Solution

So, how do we fix this? My solution is two-fold. First, for any account that should have direct access to the database files I fire up the Terminal and do the following:

sudo dscl . append /Groups/fmsadmin GroupMembership theaccountname

This will make the user’s account a member of the fmsadmin group. Even if you do nothing else, this will give the user both read & write access the the database folders and their files.

Next, we need to modify the permissions to the folder containing the database files. The default location for this is:

/Library/FileMakerServer/Data/Databases

sudo chmod o-rx /Library/FileMakerServer/Data/Databases

We have now removed the ability of anyone who isn’t fmserver or in the fmsadmin group to read the contents of the Databases folder. Next, and this is perhaps the trickiest part, we us an ACL based permission to allow the fmsadmin group full access to the Databases folder, overriding the previous POSIX style permissions. In addition to allowing the fmsadmin group read and write access, it causes all enclosed files and subdirectories to also inherit these same permissions. The somewhat lengthy command looks like this:

sudo chmod -R +a 'fmsadmin allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readsecurity,directory_inherit,file_inherit' '/Library/FileMaker Server/Data/Databases'

If logged in as a user in the fmsadmin group you should now be able to copy over new files or create directories in your Databases folder and have them pick up the correct permissions for FMS to read and write to the file. If you want to check this, just be sure to use the -e option with the ls command, otherwise the ACL’s won’t be displayed.

• Posted in filemaker
• Meta 2 comments, permalink