Re: Isn't pg_statistic a security hole?

> Hmm, that would work --- you could join against pg_class to find out the
> owner of the relation.  While you were at it, maybe look up the
> attribute name in pg_attribute as well.  Anyone want to propose a
> specific view definition?
> 

How does this work?

create view pg_userstat as (select  s.starelid ,s.staattnum ,s.staop ,s.stanullfrac ,s.stacommonfrac ,s.stacommonval
,s.staloval,s.stahival ,c.relname ,a.attname ,sh.usenamefrom   pg_statistic as s ,pg_class as c ,pg_shadow as sh
,pg_attributeas awhere (sh.usename=current_user or current_user='postgres') and sh.usesysid = c.relowner and a.attrelid
=c.oid and c.oid = s.starelid
 
);


-- Joe