Skip site navigation (1) Skip section navigation (2)

Re: lastval exposes information that currval does not

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: Alvaro Herrera <alvherre(at)commandprompt(dot)com>
Cc: Phil Frost <indigo(at)bitglue(dot)com>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: lastval exposes information that currval does not
Date: 2006-07-27 20:40:45
Message-ID: 5671.1154032845@sss.pgh.pa.us (view raw or flat)
Thread:
Lists: pgsql-hackers
Alvaro Herrera <alvherre(at)commandprompt(dot)com> writes:
> What we should really do is have lastval() fail if the user does not
> have appropiate permissions on the schema.  Having it not fail is a bug,
> and documenting a bug turns it not into a feature, but into a "gotcha".

I'm unconvinced that it's either a bug or a gotcha.  lastval doesn't
tell you which sequence it's giving you a value from, so I don't really
see the reasoning for claiming that there's a security hole.  Also,
*at the time you did the nextval* you did have permissions.  Does anyone
really think that a bad guy can't just remember the value he got?
lastval is merely a convenience.

			regards, tom lane

In response to

Responses

pgsql-hackers by date

Next:From: Alvaro HerreraDate: 2006-07-27 20:45:57
Subject: Warnings in pgstattuple
Previous:From: Tom LaneDate: 2006-07-27 20:29:53
Subject: Re: New shared memory hooks proposal (was Re:

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group