pg_settings.sourcefile patch is a security breach

Поиск
Список
Период
Сортировка
От Tom Lane
Тема pg_settings.sourcefile patch is a security breach
Дата
Msg-id 29943.1222021508@sss.pgh.pa.us
обсуждение исходный текст
Ответы Re: pg_settings.sourcefile patch is a security breach
Список pgsql-hackers
Дерево обсуждения 
We go to some lengths to prevent non-superusers from examining
data_directory and other values that would tell them exactly where the
PG data directory is in the server's filesystem.  The recently applied
patch to expose full pathnames of GUC variables' source files blows a
hole a mile wide in that.

Possible answers: don't show the path, only the file name; or
show sourcefile/sourceline as NULL to non-superusers.
        regards, tom lane

В списке pgsql-hackers по дате отправления:

Предыдущее
От: Tom Lane
Дата:
Сообщение: Re: Proposal: move column defaults into pg_attribute along with attacl
Следующее
От: Magnus Hagander
Дата:
Сообщение: Re: pg_settings.sourcefile patch is a security breach