Re: Insufficient attention to security in contrib (mostly)

Поиск
Список
Период
Сортировка
От Gregory Stark
Тема Re: Insufficient attention to security in contrib (mostly)
Дата
Msg-id 87bqctyf0i.fsf@oxford.xeocode.com
обсуждение исходный текст
Ответ на Insufficient attention to security in contrib (mostly)  (Tom Lane <tgl@sss.pgh.pa.us>)
Список pgsql-hackers
"Tom Lane" <tgl@sss.pgh.pa.us> writes:

> Lastly, int4notin() and oidnotin() have no permission checking, which
> means you can find out whether specific values are or are not present
> in an int4 or oid column you shouldn't read.  This code is so old,
> crufty, and undocumented that I'm strongly inclined to remove it
> instead of fix it --- it really has no excuse to live when we support
> IN (sub-SELECT) constructs.
>
> Comments?

Wow, those are strange beasts.

--  Gregory Stark EnterpriseDB          http://www.enterprisedb.com


В списке pgsql-hackers по дате отправления:

Предыдущее
От: Gregory Stark
Дата:
Сообщение: Re: Final background writer cleanup for 8.3
Следующее
От: "Albe Laurenz"
Дата:
Сообщение: Re: [GENERAL] Undetected corruption of table files