| From: | Joe Conway <mail(at)joeconway(dot)com> |
|---|---|
| To: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
| Cc: | Marko Kreen <markokr(at)gmail(dot)com>, Postgres Hackers <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: [patch] fix dblink security hole |
| Date: | 2008-09-22 13:52:50 |
| Message-ID: | 48D7A332.1040705@joeconway.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
Tom Lane wrote:
> Joe Conway <mail(at)joeconway(dot)com> writes:
>> Tom Lane wrote:
>>> What do you think about getting rid of the password_from_string state
>>> variable? It was always a bit of a kluge, and we don't seem to need
>>> it anymore with this approach.
>
>> It is still used in PQconnectionUsedPassword(). That is still needed to
>> prevent a non-superuser from logging in as the superuser if the server
>> does not require authentication.
>
> No, the test to see if the server actually *asked* for the password is
> the important part at that end.
Oh, I see that now. So yes, as far as I can tell, password_from_string
is not used for anything anymore and should be removed.
Joe
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tom Lane | 2008-09-22 14:03:50 | Re: WIP patch: Collation support |
| Previous Message | Tom Lane | 2008-09-22 12:24:48 | Re: pg_dump feature |