Skip site navigation (1) Skip section navigation (2)

Re: LISTEN/NOTIFY Security and the docs

From: Bruce Momjian <bruce(at)momjian(dot)us>
To: Magnus Hagander <magnus(at)hagander(dot)net>
Cc: Chander Ganesan <chander(at)otg-nc(dot)com>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: LISTEN/NOTIFY Security and the docs
Date: 2012-08-30 01:45:57
Message-ID: (view raw, whole thread or download thread mbox)
Lists: pgsql-hackers
On Thu, May 24, 2012 at 01:03:18PM +0200, Magnus Hagander wrote:
> On Fri, May 18, 2012 at 5:08 PM, Chander Ganesan <chander(at)otg-nc(dot)com> wrote:
> > Hi All,
> >
> > I just realized that anyone can listen for notifications (using listen) so
> > long as they know the "channel" name.  This means that a user could receive
> > and view the payload for another user.
> >
> > Perhaps it would be good to note this in the documentation (i.e., there
> > should be no expectation of privacy/security when using listen/notify, so
> > any user that can connect to a database could issue and receive
> > notifications for any channel.)
> Might be worth a note, yes. The lack of a note really should tell you
> that it's a broadcast, but it wouldn't hurt to have an extra one.
> Want to prepare a patch?

Attached documentation patch applied.

  Bruce Momjian  <bruce(at)momjian(dot)us>

  + It's impossible for everything to be true. +

Attachment: notify.diff
Description: text/x-diff (856 bytes)

In response to

pgsql-hackers by date

Next:From: Stephen FrostDate: 2012-08-30 01:46:06
Subject: Re: Pre-alloc ListCell's optimization
Previous:From: Bruce MomjianDate: 2012-08-30 01:30:26
Subject: Re: Pre-alloc ListCell's optimization

Privacy Policy | About PostgreSQL
Copyright © 1996-2017 The PostgreSQL Global Development Group