MySQL Permissions

[mrjasongorman]

I'm just wondering exactly what MySQL permissions are required for ProcessWire? From a security point of view i would prefer to lock down the MySQL user that ProcessWire uses to the least amount of privileges needed.

I guess it's SELECT, INSERT, UPDATE, DELETE, but do any modules create additional indexes?

Any help on this would be great.

[Francesco Bortolussi]

From what i saw ProcessWire need to CREATE tables and indexes too.

[Harmen]

42 minutes ago, Francesco Bortolussi said:

From what i saw ProcessWire need to CREATE tables and indexes too.

True

[LostKobrakai]

Each new field must be able to create it's own table and corresponding indexes. Few modules do create own tables as well.

[mrjasongorman]

Looking at the requirements i think these privileges should be enough?

Data: SELECT, INSERT, UPDATE, DELETE

Definition: CREATE, ALTER, DROP

Extra: INDEX

Similar to this requirement from Wordpress... http://wordpress.stackexchange.com/questions/6424/mysql-database-user-which-privileges-are-needed

Also points out a nice config conditional trick where by a higher privileged DB user is used in the admin area, and normal pages use lower privileges (possibly just SELECT).

Hope this helps keep ProcessWire setups even more secure.