Alvaro Herrera <alvherre(at)commandprompt(dot)com> writes:
> What we should really do is have lastval() fail if the user does not
> have appropiate permissions on the schema. Having it not fail is a bug,
> and documenting a bug turns it not into a feature, but into a "gotcha".
I'm unconvinced that it's either a bug or a gotcha. lastval doesn't
tell you which sequence it's giving you a value from, so I don't really
see the reasoning for claiming that there's a security hole. Also,
*at the time you did the nextval* you did have permissions. Does anyone
really think that a bad guy can't just remember the value he got?
lastval is merely a convenience.
regards, tom lane
In response to
pgsql-hackers by date
|Next:||From: Alvaro Herrera||Date: 2006-07-27 20:45:57|
|Subject: Warnings in pgstattuple|
|Previous:||From: Tom Lane||Date: 2006-07-27 20:29:53|
|Subject: Re: New shared memory hooks proposal (was Re: |