From: | Magnus Hagander <magnus(at)hagander(dot)net> |
---|---|
To: | Alvaro Herrera <alvherre(at)commandprompt(dot)com> |
Cc: | PG Hackers <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: Parsing errors in pg_hba.conf |
Date: | 2008-10-27 12:52:45 |
Message-ID: | 4905B99D.3040202@hagander.net |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
Alvaro Herrera wrote:
> Magnus Hagander wrote:
>> In a number of places in pg_hba.conf, we don't actually log what goes
>> wrong - instead we just goto a label that will log "invalid token \"%s\"".
>>
>> Is there any special reason for this, other than the fact that it was
>> the easy way out? I think it would be reasonable to for example log
>> "hostssl not supported on this platform" instead of that, when USE_SSL
>> is not defined, etc.
>
> Without actually looking at what you're considering, I think it could be
> a security bug if you were to disclose all the details to the user.
> Perhaps the details can be passed to errdetail_log() to avoid this
> problem.
This is during pg_hba parsing. E.g. at server start or config reload. It
doesn't run in the context of a user connection.
//Magnus
From | Date | Subject | |
---|---|---|---|
Next Message | Ibrar Ahmed | 2008-10-27 13:00:58 | Re: ERRORDATA_STACK_SIZE exceeded (server crash) |
Previous Message | Magnus Hagander | 2008-10-27 12:52:04 | Re: Parsing errors in pg_hba.conf |