From what I read, the database isn't "wide open". It's read-only and there's nothing juicy in it.
Also, a bit of NSFW stuff going on here if you dig too far.
Edit: It's not read-only, INSERT/UPDATE works.
Also, a bit of NSFW stuff going on here if you dig too far.
Edit: It's not read-only, INSERT/UPDATE works.
http://forums.somethingawful.com/showthread.php?noseen=0&...
This is a really embarrassing mistake on their part.
As it is, that's just stupid as any user can wantonly edit anything. I could trivially edit every level's author to be myself or do intensive operations which result in a DOS.
The only smart way to give clients access to a database is through some sort of frontend entirely under your control which prevents them from having the user/pass and sanitizes the queries.
Edit: Whoops, while I typed this multiple other people did the same. Sorry for the redundancy.
MySQL maybe, but enterprise DBs (think Oracle, DB2, Postgres) support a very fine-grained access model.