1

I've already prevented user to see any database (deny view any database to [login]) and it works.

But how to prevent user to list any other database using DB_NAME()?

  • Which RDBMS are you using? SQL Server? – James Anderson Apr 28 '16 at 9:16
4

DB_NAME does not work as advertised before SQL Server 2016 (where the behaviour of DB_ID is also changed). For details, see:

Information disclosure with the db_name and db_id function (Connect bug report)

There is a similar situation with other metadata functions, including:

  • suser_name
  • suser_sname
  • suser_sid
  • user_id
  • database_principal_id
  • is_rolemember
  • is_srvrolemember

These issues remain unresolved (either by design, or by being 'fixed') as of the time this answer was written, as far as I know.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.