BACKUP FILE

Lines 506 to 513 of admin/db/maintenance_db.inc:

    $res = db_query("show table status");
    $all_tables = array();
    while($row = db_fetch($res))
    {
        if (($conn["tbpref"] == "" && !preg_match('/[0-9]+_/', $row['Name'])) ||
            ($conn["tbpref"] != "" && strpos($row['Name'], $conn["tbpref"]) === 0))
            $all_tables[] = $row;
    }

gets the list of tables to be exported into the array variable $all_tables. Now all you need to do is to remove the table names you do not want from them.

To do so, after the above code insert the following:

if (($key = array_search($conn["tbpref"].'users', $all_tables)) !== false) {
    unset($all_tables[$key]);
}
if (($key = array_search($conn["tbpref"].'security_roles', $all_tables)) !== false) {
    unset($all_tables[$key]);
}

Dear APMuthu,

Thanks very much for the codes and Wiki'ed it.

I have added the codes provided and test run it, the few excluded tables still exist in the backup .sql file (please see the appended codes).  I inspected the few variables and arrays and I couldn't spot the issue.  I need your advise on this....

Another potential issue which is related to the restoration of this modified backup file.  As stated in the Wiki, the restore functions will first drop all the tables before being recreated and populated.

Wiki: "On restoration, these tables will first be dropped before being recreated and populated."

If the tables are excluded, unless the backup .sql totally ignore these excluded tables and they are not dropped during restoration.  (I hope this is the case).  Otherwise the Restoration of these excluded tables will be "emptied" and it will make the FA not functioning as the data are missing (for example, the users will not be able to login since the user table is empty).   

I'm sorry I could not contribute to the coding but I could only share my thoughts with regards to this issue.  Your help is very much appreciated.

Thank you!

KH

=====================
   $res = db_query("show table status");
    $all_tables = array();
    while($row = db_fetch($res))
    {
        if (($conn["tbpref"] == "" && !preg_match('/[0-9]+_/', $row['Name'])) ||
            ($conn["tbpref"] != "" && strpos($row['Name'], $conn["tbpref"]) === 0))
            $all_tables[] = $row;
    }
   
//Skip tables during backup:  The codes below skipped the few tables that may cause security issues such as '0_users', 'seicurity_roles' etc.

$skip_tables_list = Array('users', 'security_roles', 'sql_trail');

    foreach ($skip_tables_list as $skip_table_name) {
        if (($key = array_search($conn["tbpref"].$skip_table_name, $all_tables)) !== false) {
            unset($all_tables[$key]);
        }
    }
// End Skip Files during backup   
   
        // get table structures
    foreach ($all_tables as $table)
    {
        $res1 = db_query("SHOW CREATE TABLE `" . $table['Name'] . "`");
        $tmp = db_fetch($res1);
        $table_sql[$table['Name']] = $tmp["Create Table"];
    }
===========================

What you are describing is not a backup. It is, at best, an "undo" feature for your users. And a dangerous one, if you have more than one user.

There is no way to restore the data on a fresh system using these "backups" because, just like incremental backups, they require a "base" backup to start from.

Whatever it is you are trying to achieve, this is not the way to do it.

Restoring a backup inserts data into the database. It's not a major security issue. It's how things work.

I guess you could prevent your users from uploading/downloading backups, but that won't stop them from overwriting each other’s data. That's why you don't want to give users access to the backups on a multi-user system in the first place.