Re: Fixing insecure security definer functions

Поиск
Список
Период
Сортировка
От Sergiy Vyshnevetskiy
Тема Re: Fixing insecure security definer functions
Дата
Msg-id Pine.LNX.4.64.0708102115590.28860@uanet.vostok.net
обсуждение исходный текст
Ответ на Re: Fixing insecure security definer functions  (Tom Lane <tgl@sss.pgh.pa.us>)
Список pgsql-hackers
> 3. Add optional clauses to CREATE FUNCTION and ALTER FUNCTION to specify
> the propath value.  I suggest, but am not wedded to,
>     PATH 'foo, bar'
>     PATH NONE
> Since PATH NONE is the default, it's not really needed in CREATE
> FUNCTION, but it seems useful to allow it for ALTER FUNCTION.

I think NONE may be a bit misleading, as if path will be empty.
CURRENT sounds better for this.

Add    PATH SAVED
as shorthand to    PATH current_setting('search_path')
as well.

Default should be SAVED for SECURITY DEFINER functions.
A parameter to set the default for SECURITY INVOKER functions would be 
nice too.


В списке pgsql-hackers по дате отправления:

Предыдущее
От: Gregory Stark
Дата:
Сообщение: Re: crypting prosrc in pg_proc
Следующее
От: Steve Atkins
Дата:
Сообщение: Re: crypting prosrc in pg_proc