> -----Original Message-----
> From: Merlin Moncure [mailto:merlin.moncure@rcsonline.com]
> Sent: 16 March 2005 17:20
> To: Dave Page
> Cc: pgadmin-hackers@postgresql.org; pgadmin-hackers@postgresql.org
> Subject: RE: [pgadmin-hackers] prevent users from seeing
> pl/pgsql code in pgadmin
>
>
> What about this: do think pgAdmin should prevent rendering
> the sql code
> for various database schema objects (but especially functions) if the
> pgAdmin user does not have appropriate access to that object?
>
> For example, if user does not have the 'execute' permission,
> disable sql
> render of the function object. I think this is pretty
> reasonable from a
> security standpoint until such time that the server gets this
> capability.
To be honest I'm not keen to expend time and add to the complexity of
the code to add obscurity (I can't in good conscience call it security)
that is so easily bypassed. This seems kinda like adding an entry
control system to a door next to a large open window.
Regards, Dave.