pgsql: Disable the undocumented xmlvalidate() function, which was

Поиск
Список
Период
Сортировка
От tgl@postgresql.org (Tom Lane)
Тема pgsql: Disable the undocumented xmlvalidate() function, which was
Дата
Msg-id 20080301024649.3CDCD754108@cvs.postgresql.org
обсуждение исходный текст
Список pgsql-committers
Log Message:
-----------
Disable the undocumented xmlvalidate() function, which was unintentionally
left in the code though it was not meant to be provided.  It represents a
security hole because unprivileged users could use it to look at (at least the
first line of) any file readable by the backend.  Fortunately, this is only
possible if the backend was built with XML support, so the damage is at least
mitigated; and 8.3 probably hasn't propagated into any security-critical uses
yet anyway.  Per report from Sergey Burladyan.

Modified Files:
--------------
    pgsql/src/backend/utils/adt:
        xml.c (r1.68 -> r1.69)
        (http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/adt/xml.c?r1=1.68&r2=1.69)

В списке pgsql-committers по дате отправления:

Предыдущее
От: adunstan@postgresql.org (Andrew Dunstan)
Дата:
Сообщение: pgsql: Don't call AddUserToDacl on Cygwin
Следующее
От: tgl@postgresql.org (Tom Lane)
Дата:
Сообщение: pgsql: Disable the undocumented xmlvalidate() function, which was