Resolving External References ....in a package

Question

hi all..
Resolving External References in IR Subprogram
CREATE PROCEDURE above_salary
(emp_id IN NUMBER)
AUTHID CURRENT_USER
AS
emps NUMBER;
BEGIN
-- External reference is resolved in schema of current user:
SELECT * FROM employees
WHERE employee_id = emp_actions.num_above_salary(emp_id);
-- External reference is resolved in schema of owner of above_salary:
emps := emp_actions.num_above_salary(emp_id);
DBMS_OUTPUT.PUT_LINE
('Number of employees with higher salary: ' || TO_CHAR(emps));
END;
CALL above_salary(120);
what are the security reasons for which the references is behaving as above..
thanks in advance
gud day

Answer 1

SELECT * FROM employees
WHERE employee_id = emp_actions.num_above_salary(emp_id);
in the above statement package emp_actiosns called indirectly from a select statement ....and while executing the package above_salary which is calling emp_actions..
the resolution of the name is by currentuser.emp_actions....(INVOKER RIGHTS)
BUT..
emps := emp_actions.num_above_salary(emp_id);
DBMS_OUTPUT.PUT_LINE
('Number of employees with higher salary: ' || TO_CHAR(emps));
in this statement while executing the above salary package .....the package empaction is resolved as owner.emp_action(DEFINER RIGHTS)
WHY IS THIS DIFFERENCE IMPORTANT..WHAT ARE THE SECURITY REASONS BEHIND IT