== PostgreSQL Weekly News - April 07 2013 ==

== PostgreSQL Weekly News - April 07 2013 ==

Security releases 9.2.4, 9.1.9, 9.0.13, and 8.4.17 are out now.
Upgrade immediately if not sooner!
http://www.postgresql.org/about/news/1456/
Release FAQ:
http://www.postgresql.org/support/security/faq/2013-04-04/

PGConf.EU 2013 will be held on Oct 29-Nov 1, in at the Conrad Hotel in
downtown Dublin, Ireland.
http://2013.pgconf.eu/

== PostgreSQL Product News ==

psycopg2 2.5, a Python connector for PostgreSQL, released.
http://initd.org/psycopg/articles/2013/04/07/psycopg-25-released/

== PostgreSQL Jobs for April ==

http://archives.postgresql.org/pgsql-jobs/2013-04/threads.php

== PostgreSQL Local ==

PGCon 2013 will be held May 23-24 2013, in Ottawa at the University of
Ottawa.
http://www.pgcon.org/2013/

The 6th annual "Prague PostgreSQL Developers Day" conference,
organized by CSPUG (Czech and Slovak PostgreSQL Users Group), will be
held on May 30, 2013 at Faculty of Mathematics and Physics, Charles
University (Malostranske namesti 25, Prague). The CfP is open until
April 14, 2013 <info AT p2d2 DOT cz>. More information in Czech is at
http://www.p2d2.cz/

PG Day France is the major French-speaking PostgreSQL community event.
It will be held June 13, 2013 in Nantes, France.
http://pgday.fr/

The CfPs for Char(13) and PGday UK, July 11 and 12, 2013,
respectively, are out and close April 19, 2013. For Char(13), write
speakers AT char13 DOT info; for PGday UK, speakers AT
postgresqlusergroup DOT org DOT uk.

PostgreSQL Brazil will be held August 15-17, 2013 in Porto Velho, RO,
Brazil.
http://pgbr.postgresql.org.br/2013/chamada.en.php

Save The Date!
Postgres Open 2013 will be in Chicago, IL, USA, September 16-18.
Hotel Sax:
https://reservations.ihotelier.com/crs/g_reservation.cfm?groupID=888761&hotelID=6865
Early Bird registration:
http://postgresopen-eac2.eventbrite.com/

== PostgreSQL in the News ==

Planet PostgreSQL: http://planet.postgresql.org/

PostgreSQL Weekly News is brought to you this week by David Fetter

Submit news and announcements by Sunday at 3:00pm Pacific time.
Please send English language ones to david(at)fetter(dot)org, German language
to pwn(at)pgug(dot)de, Italian language to pwn(at)itpug(dot)org(dot) Spanish language
to pwn(at)arpug(dot)com(dot)ar(dot)

== Applied Patches ==

Peter Eisentraut pushed:

- Revert "ecpg: Don't link compatlib with libpq". This reverts commit
3780fc679cc428c1f211e1728c4281ca15e9746b. HP-UX didn't like it.
There would probably be a way to fix that, but since the net effect
of all of this is zero because ecpg ends up using libpq anyway, it's
not worth bothering further.
http://git.postgresql.org/pg/commitdiff/85079078acb4f120335f54f38f93635dd8c8b83d

- doc: Fix number of columns in table
http://git.postgresql.org/pg/commitdiff/e3f719c3671c293bf9e1a7293c7bd5eb6d9a2611

Tom Lane pushed:

- Make REPLICATION privilege checks test current user not
authenticated user. The pg_start_backup() and pg_stop_backup()
functions checked the privileges of the initially-authenticated user
rather than the current user, which is wrong. For example, a
user-defined index function could successfully call these functions
when executed by ANALYZE within autovacuum. This could allow an
attacker with valid but low-privilege database access to interfere
with creation of routine backups. Reported and fixed by Noah Misch.
Security: CVE-2013-1901
http://git.postgresql.org/pg/commitdiff/ce9ab88981495d975aade8fc664f99f68fc18e2b

- Avoid updating our PgBackendStatus entry when track_activities is
off. The point of turning off track_activities is to avoid this
reporting overhead, but a thinko in commit
4f42b546fd87a80be30c53a0f2c897acb826ad52 caused
pgstat_report_activity() to perform half of its updates anyway. Fix
that, and also make sure that we clear all the now-disabled fields
when transitioning to the non-reporting state.
http://git.postgresql.org/pg/commitdiff/f7b0006f42913b6d641c9f0bef6fad1f670b9194

- Fix typo in FDW docs. Laurenz Albe
http://git.postgresql.org/pg/commitdiff/0f1345d38b4d7b35175d4f4be322da0aa6d6aaeb

- Minor robustness improvements for isolationtester. Notice and
complain about PQcancel() failures. Also, don't dump core if an
error PGresult doesn't contain severity and message subfields, as it
might not if it was generated by libpq itself. (We have a
longstanding TODO item to improve that, but in the meantime
isolationtester had better cope.) I tripped across the latter item
while investigating a trouble report on buildfarm member spoonbill.
As for the former, there's no evidence that PQcancel failure is
actually involved in spoonbill's problem, but it still seems like a
bad idea to ignore an error return code.
http://git.postgresql.org/pg/commitdiff/845d335a90b684dd51e80a6470ebb923a59a1f91

- Update release notes for 9.2.4, 9.1.9, 9.0.13, 8.4.17. Security:
CVE-2013-1899, CVE-2013-1901
http://git.postgresql.org/pg/commitdiff/89b661bab99e8573fad271f68755ba286932dec2

- Fix insecure parsing of server command-line switches. An oversight
in commit e710b65c1c56ca7b91f662c63d37ff2e72862a94 allowed database
names beginning with "-" to be treated as though they were secure
command-line switches; and this switch processing occurs before
client authentication, so that even an unprivileged remote attacker
could exploit the bug, needing only connectivity to the postmaster's
port. Assorted exploits for this are possible, some requiring a
valid database login, some not. The worst known problem is that the
"-r" switch can be invoked to redirect the process's stderr output,
so that subsequent error messages will be appended to any file the
server can write. This can for example be used to corrupt the
server's configuration files, so that it will fail when next
restarted. Complete destruction of database tables is also
possible. Fix by keeping the database name extracted from a startup
packet fully separate from command-line switches, as had already
been done with the user name field. The Postgres project thanks
Mitsumasa Kondo for discovering this bug, Kyotaro Horiguchi for
drafting the fix, and Noah Misch for recognizing the full extent of
the danger. Security: CVE-2013-1899
http://git.postgresql.org/pg/commitdiff/17fe2793ea7fe269ed616cb305150b6cf38dbaa8

- Improve documentation about the relationship of extensions and
schemas. There's been some confusion expressed about this point, so
clarify. Extended version of a patch by David Wheeler.
http://git.postgresql.org/pg/commitdiff/52f436b807b0d02203ea6be19bafa56e4e1381e8

- Fix line count in slashUsage(). Counting newlines shows that quite
a few recent patches have neglected to update the output-lines count
given to PageOutput(). Fortunately it's not terribly critical that
this be exact, since we long since exceeded the height of most
people's terminal windows. Still, maybe we ought to think of a way
to not have to maintain this manually anymore.
http://git.postgresql.org/pg/commitdiff/927e1dc96ce3eb4a618fd7b67f69eec72b56d850

- Add \watch [SEC] command to psql. This allows convenient
re-execution of commands. Will Leinweber, reviewed by Peter
Eisentraut, Daniel Farina, and Tom Lane
http://git.postgresql.org/pg/commitdiff/c6a3fce7dd4dae6e1a005e5b09cdd7c1d7f9c4f4

- In isolationtester, retry after EINTR return from select(2). Per
report from Jaime Casanova. Very curious that no one else has seen
this failure ... but the code is clearly wrong as-is.
http://git.postgresql.org/pg/commitdiff/faf4726c9fd5748ad25dbce55a7d31deeabe9866

- Get rid of USE_WIDE_UPPER_LOWER dependency in trigram construction.
contrib/pg_trgm's make_trigrams() was coded to ignore multibyte
character boundaries and just make trigrams from bytes if
USE_WIDE_UPPER_LOWER wasn't defined. This is a bit odd, since
there's no obvious reason why trigram compaction rules should depend
on the presence of towlower() and friends. What's more, there was
an Assert() that would fail if that code path was fed any multibyte
characters. We need to do something about this since the pending
regex-indexing patch has an assumption that you get just one "trgm"
from any three characters. The best solution seems to be to remove
the USE_WIDE_UPPER_LOWER dependency, which shouldn't really have
been there in the first place. The second loop in make_trigrams()
is now just a fast path and not a potentially incompatible
algorithm. If there is anybody still using Postgres on machines
without wcstombs() or towlower(), and they have non-ASCII data
indexed by pg_trgm, they'll need to REINDEX those indexes after
pg_upgrade to 9.3, else searches may fail incorrectly. It seems
likely that there are no such installations, though. In passing,
rename cnt_trigram to compact_trigram, which seems to better
describe its functionality, and improve make_trigrams' test for
whether it has to use the slow path or not (per a suggestion from
Alexander Korotkov).
http://git.postgresql.org/pg/commitdiff/7844608e54a3a2e3dee461b00fd6ef028a845d7c

Heikki Linnakangas pushed:

- Calculate # of semaphores correctly with --disable-spinlocks. The
old formula didn't take into account that each WAL sender process
needs a spinlock. We had also already exceeded the fixed number of
spinlocks reserved for misc purposes (10). Bump that to 30.
Backpatch to 9.0, where WAL senders were introduced. If I counted
correctly, 9.0 had exactly 10 predefined spinlocks, and 9.1 exceeded
that, but bump the limit in 9.0 too because 10 is uncomfortably
close to the edge.
http://git.postgresql.org/pg/commitdiff/b8ed4cc9627de437e5eafdb81631a0d0f063abb3

- Fix crash on compiling a regular expression with more than 32k
colors. Throw an error instead. Backpatch to all supported
branches.
http://git.postgresql.org/pg/commitdiff/bf2b0a147857f63daa2e5c17eed0169861371af8

Andrew Dunstan pushed:

- Fix a few thinkos in the JSON functions docs. Dickson S. Guedes
http://git.postgresql.org/pg/commitdiff/d7d5832012ae5174707643af1a450d26d3350719

- Fix off by one error in JSON extract path code. Bug report by David
Wheeler, diagnosis assistance from Tom Lane.
http://git.postgresql.org/pg/commitdiff/e75feb28341ea49e9d41266906e701a4e3742e2e

Bruce Momjian pushed:

- psql: fix startup crash caused by PSQLRC containing a tilde.
'strdup' the PSQLRC environment variable value before calling a
routine that might free() it. Backpatch to 9.2, where the bug first
appeared.
http://git.postgresql.org/pg/commitdiff/48a2cd370e2610f0a196240aed9f5abd82d3dada

Robert Haas pushed:

- sepgsql: Enforce db_schema:search permission. KaiGai Kohei, with
comment and doc wordsmithing by me
http://git.postgresql.org/pg/commitdiff/e965e6344cfaff0708a032721b56f61eea777bc5

Simon Riggs pushed:

- Fix checksums for CLUSTER, VACUUM FULL etc. In CLUSTER, VACUUM FULL
and ALTER TABLE SET TABLESPACE I erroneously set checksum before
log_newpage, which sets the LSN and invalidates the checksum. So set
checksum immediately *after* log_newpage. Bug report Fujii Masao,
Fix and patch by Jeff Davis
http://git.postgresql.org/pg/commitdiff/cf8dc9e10c0d954970cbe5ca9be4c6b881cde482

- Tune BufferGetLSNAtomic() when checksums !enabled. From performance
analysis by Heikki Linnakangas
http://git.postgresql.org/pg/commitdiff/1be203519ac4da238bf6dfe8f7015d5780723e0f

== Rejected Patches (for now) ==

No one was disappointed this week :-)

== Pending Patches ==

Jeff Janes sent in another revision of a patch to add a --startup
option to pgbench.

Tom Lane sent in a patch to fix some mis-estimation of the costs of
hash joins.

Alexander Korotkov and Tom Lane, with contributions of performance
numbers from Erik Rijkers, sent in more revisions of the patch to
allow indexing DFA regexes.

Jeff Janes sent in another revision of a patch to change the units of
spinlock_delay to microseconds.

Dimitri Fontaine sent in two more revisions of a patch to add
extension templates.

Andres Freund sent in a patch to add option for dumping full page
writes to pg_dump.

Michael Paquier sent in a patch to fix a typo in the documentation for
JSON functions.

Heikki Linnakangas sent in a patch to ensure that enough WAL segments
are kept in situations where they might not have been.

Heikki Linnakangas sent in a patch to prevent backend crashes with
certain unusual regexes.

Simon Riggs, Andres Freund and Jeff Davis traded patches to fix some
corner cases in the page checksum code.

Grzegorz Jaskiewicz and Robert Haas traded patches to remove some
formatting dead code.

Kevin Grittner sent in a patch to fix some scannability issues in
materialized views.

Jeff Janes sent in a patch to help ensure that the right WALs get
saved.

Jeff Janes sent in a patch to ensure that the process title of the
autovacuum worker reflects what it's doing at the time.

Tomas Vondra sent in a patch to implement pg_stat_agg_database.