Mike

I hope this helps!
-T. J.

create or replace
TRIGGER CHK_CREATE_PRIVS_TRG
BEFORE CREATE ON DATABASE
DECLARE
— CREATE ROLE viewsource;
— GRANT CREATE ANY PROCEDURE TO viewsource;
— GRANT viewsource TO :user;
e_no_priv EXCEPTION;
BEGIN
–
— Note – bitter experience teaches us to always leave a back-door
— for SYS and SYSTEM in a trigger such as this – just in case
— it doesn’t quite work as expected first time !
–
IF ( USER NOT IN (‘SYS’, ‘SYSTEM’)
AND ORA_DICT_OBJ_TYPE IN (‘FUNCTION’, ‘PROCEDURE’, ‘PACKAGE’, ‘PACKAGE BODY’)
) THEN
— This query needs to check where the relevant privilege
— is inherited from ( or whether it’s granted directly)
–
FOR r IN (
SELECT 1
FROM SYS.DBA_SYS_PRIVS
WHERE PRIVILEGE IN (
CASE ora_dict_obj_owner
WHEN USER
THEN ‘CREATE PROCEDURE’
ELSE ‘CREATE ANY PROCEDURE’
END, ‘CREATE ANY PROCEDURE’
)
AND ( GRANTEE = USER
OR GRANTEE IN (
SELECT GRANTED_ROLE
FROM SYS.DBA_ROLE_PRIVS
WHERE GRANTED_ROLE != ‘VIEWSOURCE’
START WITH GRANTEE = USER
CONNECT BY PRIOR GRANTED_ROLE = GRANTEE
)
)
AND rownum = 1
)
LOOP
RETURN ;
END LOOP;
END IF ;
RAISE e_no_priv;

EXCEPTION
WHEN e_no_priv THEN
RAISE_APPLICATION_ERROR( -20001, ‘You must have create privileges other than through VIEWSOURCE to do this.’);
END;
/

I was assuming that, as this was a controlled environment :

1) The supporter would not have any write privs ( as in the post)
2) SQLDeveloper would not be used as an end-user tool at-all.

A wise man once said “Assumption is the mother of all cock-ups”. Well, maybe he didn’t, but he jolly well should have.

Anyhow, changing the where clause in the c_has_priv trigger as follows might help :

WHERE privilege IN
CASE ora_dict_obj_owner 
     WHEN USER THEN 'CREATE PROCEDURE'
      ELSE 'CREATE ANY PROCEDURE'
END, 'CREATE ANY PROCEDURE'

So, when a user is trying to create an object in their own schema the IN list should evaluate to ‘CREATE PROCEDURE’, ‘CREATE ANY PROCEDURE’.
When the object is being created in another schema the IN list should evaluate to ‘CREATE ANY PROCEDURE’, ‘CREATE ANY PROCEDURE’.

Not the most elegant solution, I grant you, but it does seem to be quite effective.