Re: Insufficient attention to security in contrib (mostly)

Tom Lane wrote:
> * no restriction on database-size function *when applied to the current
> database* (again, you could look into pg_class); to apply to some other
> database, you must have connect privileges.  (Actually, on the
> assumption that you must have connect privs to current DB, I guess we
> could simplify that to connect privs on target DB, full stop.)

The latter would be preferrable for pgAdmin which queries database-level
info from the maintenance DB (usually postgres).

> * tablespace-size function requires being owner of current DB.

I assume superusers will also be able to use it, not just the actual owner?

/D