Alvaro Herrera wrote:
> Tom Lane wrote:
> > Alvaro Herrera <alvherre(at)commandprompt(dot)com> writes:
> > > Tom Lane wrote:
> > >> It looks to me like the code in AlterSetting() will allow an ordinary
> > >> user to blow away all settings for himself. Even those that are for
> > >> SUSET variables and were presumably set for him by a superuser. Isn't
> > >> this a security hole? I would expect that an unprivileged user should
> > >> not be able to change such settings, not even to the extent of
> > >> reverting to the installation-wide default.
> > > Yes, it is, but this is not a new hole. This works just fine in 8.4
> > > too:
> > So I'd argue for changing it in 8.4 too.
> Understood. I'm starting to look at what this requires.
Any progress on this?
Bruce Momjian <bruce(at)momjian(dot)us> http://momjian.us
PG East: http://www.enterprisedb.com/community/nav-pg-east-2010.do
+ If your life is a hard drive, Christ can be your backup. +
In response to
pgsql-hackers by date
|Next:||From: Greg Stark||Date: 2010-02-27 03:40:57|
|Subject: Re: Hot Standby query cancellation and Streaming Replication integration|
|Previous:||From: Bruce Momjian||Date: 2010-02-27 03:29:30|
|Subject: Re: plpgsql: numeric assignment to an integer
variable errors out|