Re: [patch] fix dblink security hole

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: Joe Conway <mail(at)joeconway(dot)com>
Cc: Marko Kreen <markokr(at)gmail(dot)com>, Postgres Hackers <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: [patch] fix dblink security hole
Date: 2008-09-22 03:44:05
Message-ID: 26935.1222055045@sss.pgh.pa.us
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Joe Conway <mail(at)joeconway(dot)com> writes:
> Tom Lane wrote:
>> Refactoring doesn't seem like an easy way to fix this, because of the
>> problem that the behavior of pulling up defaults is part of the API
>> specification for PQconndefaults().

> conninfo_parse() is presently only called from a few places -- maybe we
> should have conninfo_parse() really just parse, and create a new
> conninfo_get_missing() or some such that fills in missing values?

Doh, I must be too tired, because now that seems obvious. Will set this
aside and try it again tomorrow.

regards, tom lane

In response to

Browse pgsql-hackers by date

  From Date Subject
Next Message Joe Conway 2008-09-22 03:44:11 Re: [patch] fix dblink security hole
Previous Message Joe Conway 2008-09-22 03:40:02 Re: [patch] fix dblink security hole