aboutsummaryrefslogtreecommitdiff
path: root/doc/src
diff options
context:
space:
mode:
Diffstat (limited to 'doc/src')
-rw-r--r--doc/src/sgml/config.sgml16
-rw-r--r--doc/src/sgml/ref/create_function.sgml50
-rw-r--r--doc/src/sgml/release.sgml121
3 files changed, 162 insertions, 25 deletions
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 75da5f2bfd9..4a56e85b5da 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1,5 +1,5 @@
<!--
-$PostgreSQL: pgsql/doc/src/sgml/config.sgml,v 1.36.2.7 2006/11/04 18:20:40 tgl Exp $
+$PostgreSQL: pgsql/doc/src/sgml/config.sgml,v 1.36.2.8 2007/04/20 02:38:04 tgl Exp $
-->
<chapter Id="runtime-config">
<title>Server Configuration</title>
@@ -3103,9 +3103,17 @@ SELECT * FROM parent WHERE key = 2400;
mentioned in the path then it will be searched in the specified
order. If <literal>pg_catalog</> is not in the path then it will
be searched <emphasis>before</> searching any of the path items.
- It should also be noted that the temporary-table schema,
- <literal>pg_temp_<replaceable>nnn</></>, is implicitly searched before any of
- these.
+ </para>
+
+ <para>
+ Likewise, the current session's temporary-table schema,
+ <literal>pg_temp_<replaceable>nnn</></>, is always searched if it
+ exists. It can be explicitly listed in the path by using the
+ alias <literal>pg_temp</>. If it is not listed in the path then
+ it is searched first (before even <literal>pg_catalog</>). However,
+ the temporary schema is only searched for relation (table, view,
+ sequence, etc) and data type names. It will never be searched for
+ function or operator names.
</para>
<para>
diff --git a/doc/src/sgml/ref/create_function.sgml b/doc/src/sgml/ref/create_function.sgml
index 022a26c6b09..e761f088417 100644
--- a/doc/src/sgml/ref/create_function.sgml
+++ b/doc/src/sgml/ref/create_function.sgml
@@ -1,5 +1,5 @@
<!--
-$PostgreSQL: pgsql/doc/src/sgml/ref/create_function.sgml,v 1.67 2005/11/01 21:09:50 tgl Exp $
+$PostgreSQL: pgsql/doc/src/sgml/ref/create_function.sgml,v 1.67.2.1 2007/04/20 02:38:04 tgl Exp $
-->
<refentry id="SQL-CREATEFUNCTION">
@@ -473,6 +473,54 @@ SELECT * FROM dup(42);
</para>
</refsect1>
+ <refsect1 id="sql-createfunction-security">
+ <title>Writing <literal>SECURITY DEFINER</literal> Functions Safely</title>
+
+ <para>
+ Because a <literal>SECURITY DEFINER</literal> function is executed
+ with the privileges of the user that created it, care is needed to
+ ensure that the function cannot be misused. For security,
+ <xref linkend="guc-search-path"> should be set to exclude any schemas
+ writable by untrusted users. This prevents
+ malicious users from creating objects that mask objects used by the
+ function. Particularly important is in this regard is the
+ temporary-table schema, which is searched first by default, and
+ is normally writable by anyone. A secure arrangement can be had
+ by forcing the temporary schema to be searched last. To do this,
+ write <literal>pg_temp</> as the last entry in <varname>search_path</>.
+ This function illustrates safe usage:
+ </para>
+
+<programlisting>
+CREATE FUNCTION check_password(uname TEXT, pass TEXT)
+RETURNS BOOLEAN AS $$
+DECLARE passed BOOLEAN;
+ old_path TEXT;
+BEGIN
+ -- Save old search_path; notice we must qualify current_setting
+ -- to ensure we invoke the right function
+ old_path := pg_catalog.current_setting('search_path');
+
+ -- Set a secure search_path: trusted schemas, then 'pg_temp'.
+ -- We set is_local = true so that the old value will be restored
+ -- in event of an error before we reach the function end.
+ PERFORM pg_catalog.set_config('search_path', 'admin, pg_temp', true);
+
+ -- Do whatever secure work we came for.
+ SELECT (pwd = $2) INTO passed
+ FROM pwds
+ WHERE username = $1;
+
+ -- Restore caller's search_path
+ PERFORM pg_catalog.set_config('search_path', old_path, true);
+
+ RETURN passed;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+</programlisting>
+
+ </refsect1>
+
<refsect1 id="sql-createfunction-compat">
<title>Compatibility</title>
diff --git a/doc/src/sgml/release.sgml b/doc/src/sgml/release.sgml
index 81dd645e8dd..b1bf376f2b4 100644
--- a/doc/src/sgml/release.sgml
+++ b/doc/src/sgml/release.sgml
@@ -1,4 +1,4 @@
-<!-- $PostgreSQL: pgsql/doc/src/sgml/release.sgml,v 1.400.2.41 2007/04/19 13:02:30 momjian Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/release.sgml,v 1.400.2.42 2007/04/20 02:38:04 tgl Exp $ -->
<!--
Typical markup:
@@ -28,7 +28,8 @@ For new features, add links to the documentation sections.
</note>
<para>
- This release contains fixes from 8.1.8.
+ This release contains a variety of fixes from 8.1.8,
+ including a security fix.
</para>
<sect2>
@@ -49,39 +50,57 @@ For new features, add links to the documentation sections.
<listitem>
<para>
- Fix <function>to_char()</> so it properly upper/lower cases localized day or month
- names (Pavel Stehule)
+ Support explicit placement of the temporary-table schema within
+ <varname>search_path</>, and disable searching it for functions
+ and operators (Tom)
+ </para>
+ <para>
+ This is needed to allow a security-definer function to set a
+ truly secure value of <varname>search_path</>. Without it,
+ an unprivileged SQL user can use temporary objects to execute code
+ with the privileges of the security-definer function (CVE-2007-2138).
+ See <xref linkend="sql-createfunction"
+ endterm="sql-createfunction-title"> for more information.
</para>
</listitem>
<listitem>
<para>
- <filename>/contrib/tsearch2</> fixes (Teodor)
+ <filename>/contrib/tsearch2</> crash fixes (Teodor)
</para>
</listitem>
<listitem>
<para>
- Require <command>COMMIT TRANSACTION</> to be executed in the same database as
- it was prepared (Heikki)
+ Require <command>COMMIT PREPARED</> to be executed in the same
+ database as the transaction was prepared in (Heikki)
</para>
</listitem>
<listitem>
<para>
- Improve detection of <acronym>POSIX</>-style time zone names (Tom)
+ Fix potential-data-corruption bug in how <command>VACUUM FULL</> handles
+ <command>UPDATE</> chains (Tom, Pavan Deolasee)
</para>
</listitem>
<listitem>
<para>
- Fix bug in how <command>VACUUM FULL</> handles <command>UPDATE</> chains (Tom, Pavan Deolasee)
+ Planner fixes, including improving outer join and bitmap scan
+ selection logic (Tom)
</para>
</listitem>
<listitem>
<para>
- Improve outer join and bitmap join selection logic (Tom)
+ Fix PANIC during enlargement of a hash index (bug introduced in 8.1.6)
+ (Tom)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Fix POSIX-style timezone specs to follow new USA DST rules (Tom)
</para>
</listitem>
@@ -3047,7 +3066,8 @@ psql -t -f fixseq.sql db1 | psql -e db1
</note>
<para>
- This release contains fixes from 8.0.12.
+ This release contains a variety of fixes from 8.0.12,
+ including a security fix.
</para>
<sect2>
@@ -3068,25 +3088,43 @@ psql -t -f fixseq.sql db1 | psql -e db1
<listitem>
<para>
- <filename>/contrib/tsearch2</> fixes (Teodor)
+ Support explicit placement of the temporary-table schema within
+ <varname>search_path</>, and disable searching it for functions
+ and operators (Tom)
+ </para>
+ <para>
+ This is needed to allow a security-definer function to set a
+ truly secure value of <varname>search_path</>. Without it,
+ an unprivileged SQL user can use temporary objects to execute code
+ with the privileges of the security-definer function (CVE-2007-2138).
+ See <xref linkend="sql-createfunction"
+ endterm="sql-createfunction-title"> for more information.
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ <filename>/contrib/tsearch2</> crash fixes (Teodor)
</para>
</listitem>
<listitem>
<para>
- Improve detection of <acronym>POSIX</>-style time zone names (Tom)
+ Fix potential-data-corruption bug in how <command>VACUUM FULL</> handles
+ <command>UPDATE</> chains (Tom, Pavan Deolasee)
</para>
</listitem>
<listitem>
<para>
- Fix bug in how <command>VACUUM FULL</> handles <command>UPDATE</> chains (Tom, Pavan Deolasee)
+ Fix PANIC during enlargement of a hash index (bug introduced in 8.0.10)
+ (Tom)
</para>
</listitem>
<listitem>
<para>
- <filename>/contrib/tsearch2</> fixes (Teodor)
+ Fix POSIX-style timezone specs to follow new USA DST rules (Tom)
</para>
</listitem>
@@ -6537,7 +6575,8 @@ typedefs (Michael)</para></listitem>
</note>
<para>
- This release contains a variety of fixes from 7.4.16.
+ This release contains fixes from 7.4.16,
+ including a security fix.
</para>
<sect2>
@@ -6558,13 +6597,37 @@ typedefs (Michael)</para></listitem>
<listitem>
<para>
- <filename>/contrib/tsearch2</> fixes (Teodor)
+ Support explicit placement of the temporary-table schema within
+ <varname>search_path</>, and disable searching it for functions
+ and operators (Tom)
+ </para>
+ <para>
+ This is needed to allow a security-definer function to set a
+ truly secure value of <varname>search_path</>. Without it,
+ an unprivileged SQL user can use temporary objects to execute code
+ with the privileges of the security-definer function (CVE-2007-2138).
+ See <xref linkend="sql-createfunction"
+ endterm="sql-createfunction-title"> for more information.
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ <filename>/contrib/tsearch2</> crash fixes (Teodor)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Fix potential-data-corruption bug in how <command>VACUUM FULL</> handles
+ <command>UPDATE</> chains (Tom, Pavan Deolasee)
</para>
</listitem>
<listitem>
<para>
- Fix bug in how <command>VACUUM FULL</> handles <command>UPDATE</> chains (Tom, Pavan Deolasee)
+ Fix PANIC during enlargement of a hash index (bug introduced in 7.4.15)
+ (Tom)
</para>
</listitem>
@@ -9697,7 +9760,8 @@ DROP SCHEMA information_schema CASCADE;
</note>
<para>
- This release contains a variety of fixes from 7.3.18.
+ This release contains fixes from 7.3.18,
+ including a security fix.
</para>
<sect2>
@@ -9718,7 +9782,24 @@ DROP SCHEMA information_schema CASCADE;
<listitem>
<para>
- Fix bug in how <command>VACUUM FULL</> handles <command>UPDATE</> chains (Tom, Pavan Deolasee)
+ Support explicit placement of the temporary-table schema within
+ <varname>search_path</>, and disable searching it for functions
+ and operators (Tom)
+ </para>
+ <para>
+ This is needed to allow a security-definer function to set a
+ truly secure value of <varname>search_path</>. Without it,
+ an unprivileged SQL user can use temporary objects to execute code
+ with the privileges of the security-definer function (CVE-2007-2138).
+ See <xref linkend="sql-createfunction"
+ endterm="sql-createfunction-title"> for more information.
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Fix potential-data-corruption bug in how <command>VACUUM FULL</> handles
+ <command>UPDATE</> chains (Tom, Pavan Deolasee)
</para>
</listitem>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-07 18:21:06 +0000