aboutsummaryrefslogtreecommitdiff
path: root/doc/src
Commit message (Collapse)AuthorAge
* Use a separate interpreter for each calling SQL userid in plperl and pltcl.Tom Lane2010-09-30
| | | | | | | | | | | | | | | | | | | | | | | | | There are numerous methods by which a Perl or Tcl function can subvert the behavior of another such function executed later; for example, by redefining standard functions or operators called by the target function. If the target function is SECURITY DEFINER, or is called by such a function, this means that any ordinary SQL user with Perl or Tcl language usage rights can do essentially anything with the privileges of the target function's owner. To close this security hole, create a separate Perl or Tcl interpreter for each SQL userid under which plperl or pltcl functions are executed within a session. However, all plperlu or pltclu functions run within a session still share a single interpreter, since they all execute at the trust level of a database superuser anyway. Note: this change results in a functionality loss when libperl has been built without the "multiplicity" option: it's no longer possible to call plperl functions under different userids in one session, since such a libperl can't support multiple interpreters in one process. However, such a libperl already failed to support concurrent use of plperl and plperlu, so it's likely that few people use such versions with Postgres. Security: CVE-2010-3433
* Update release notes for releases 9.0.1, 8.4.5, 8.3.12, 8.2.18, 8.1.22,Tom Lane2010-09-30
| | | | 8.0.26, and 7.4.30.
* Do some copy-editing on the Git usage docs.Tom Lane2010-09-22
|
* Fix documentation gitignore for pre-9.0 doc build methods.Tom Lane2010-09-22
|
* Remove anonymous cvs instructions, and replace them with instructionsMagnus Hagander2010-09-22
| | | | for git. Change other references from cvs to git as well.
* Convert cvsignore to gitignore, and add .gitignore for build targets.Magnus Hagander2010-09-22
|
* Fix one more incorrect errno definition in the ECPG manual.Robert Haas2010-08-11
| | | | Again, back-patch all the way to 7.4.
* Fix incorrect errno definitions in ECPG manual.Robert Haas2010-08-11
| | | | | | | ecpgerrno.h hasn't materially changed since PostgreSQL 7.4, so this has been wrong for a very long time. Back-patch all the way. Satoshi Nagayasu
* Fix grammarPeter Eisentraut2010-07-26
| | | | backpatched to 8.1
* Fix assorted misstatements and poor wording in the descriptions of the I/OTom Lane2010-07-03
| | | | | | | | | formats for geometric types. Per bug #5536 from Jon Strait, and my own testing. Back-patch to all supported branches, since this doco has been wrong right along -- we certainly haven't changed the I/O behavior of these types in many years.
* Fix longstanding typo in V1 calling conventions documentation.Robert Haas2010-05-16
| | | | Erik Rijkers
* Improve documentation of pg_restore's -l and -L switches to point out theirTom Lane2010-05-15
| | | | | interactions with filtering switches, such as -n and -t. Per a complaint from Russell Smith.
* Update release notes with security issues.Tom Lane2010-05-13
| | | | Security: CVE-2010-1169, CVE-2010-1170
* Use an entity instead of non-ASCII letter. Thom BrownTom Lane2010-05-13
|
* Prevent PL/Tcl from loading the "unknown" module from pltcl_modules unlessTom Lane2010-05-13
| | | | | | | | | | | | | | | | | | | that is a regular table or view owned by a superuser. This prevents a trojan horse attack whereby any unprivileged SQL user could create such a table and insert code into it that would then get executed in other users' sessions whenever they call pltcl functions. Worse yet, because the code was automatically loaded into both the "normal" and "safe" interpreters at first use, the attacker could execute unrestricted Tcl code in the "normal" interpreter without there being any pltclu functions anywhere, or indeed anyone else using pltcl at all: installing pltcl is sufficient to open the hole. Change the initialization logic so that the "unknown" code is only loaded into an interpreter when the interpreter is first really used. (That doesn't add any additional security in this particular context, but it seems a prudent change, and anyway the former behavior violated the principle of least astonishment.) Security: CVE-2010-1170
* Abandon the use of Perl's Safe.pm to enforce restrictions in plperl, as it isAndrew Dunstan2010-05-13
| | | | | | | | | | | | | | | | | | | | | | | | fundamentally insecure. Instead apply an opmask to the whole interpreter that imposes restrictions on unsafe operations. These restrictions are much harder to subvert than is Safe.pm, since there is no container to be broken out of. Backported to release 7.4. In releases 7.4, 8.0 and 8.1 this also includes the necessary backporting of the two interpreters model for plperl and plperlu adopted in release 8.2. In versions 8.0 and up, the use of Perl's POSIX module to undo its locale mangling on Windows has become insecure with these changes, so it is replaced by our own routine, which is also faster. Nice side effects of the changes include that it is now possible to use perl's "strict" pragma in a natural way in plperl, and that perl's $a and $b variables now work as expected in sort routines, and that function compilation is significantly faster. Tim Bunce and Andrew Dunstan, with reviews from Alex Hunsaker and Alexey Klyukin. Security: CVE-2010-1169
* Preliminary release notes for releases 8.4.4, 8.3.11, 8.2.17, 8.1.21, 8.0.25,Tom Lane2010-05-12
| | | | 7.4.29.
* IP port -> TCP portPeter Eisentraut2010-04-15
| | | | backpatched to 8.1, where this first appeared
* Typo fixes.Magnus Hagander2010-03-17
| | | | Fujii Masao
* Preliminary release notes for releases 8.4.3, 8.3.10, 8.2.16, 8.1.20, 8.0.24,Tom Lane2010-03-10
| | | | 7.4.28.
* Add missing space in example.Magnus Hagander2010-03-08
| | | | Tim Landscheidt
* Back-patch addition of ssl_renegotiation_limit into 7.4 through 8.1.Tom Lane2010-02-25
|
* Update release notes for releases 8.4.2, 8.3.9, 8.2.15, 8.1.19, 8.0.23,Tom Lane2009-12-10
| | | | 7.4.27.
* Fix erroneous handling of shared dependencies (ie dependencies on roles)Tom Lane2009-10-02
| | | | | | | | | | | | | | in CREATE OR REPLACE FUNCTION. The original code would update pg_shdepend as if a new function was being created, even if it wasn't, with two bad consequences: pg_shdepend might record the wrong owner for the function, and any dependencies for roles mentioned in the function's ACL would be lost. The fix is very easy: just don't touch pg_shdepend at all when doing a function replacement. Also update the CREATE FUNCTION reference page, which never explained exactly what changes and doesn't change in a function replacement. In passing, fix the CREATE VIEW reference page similarly; there's no code bug there, but the docs didn't say what happens.
* Final updates of release notes for 8.4.1, 8.3.8, 8.2.14, 8.1.18, 8.0.22,Tom Lane2009-09-03
| | | | 7.4.26.
* Update release notes for 7.4.26, 8.0.22, 8.1.18, 8.2.14, 8.3.8, 8.4.1.Bruce Momjian2009-08-27
|
* Remove tabs from SGML.Bruce Momjian2009-08-15
|
* Re-add documentation for --no-readline option of psql, mistakenly removed a ↵Andrew Dunstan2009-08-10
| | | | decade ago. Backpatch to release 7.4.
* Split the release notes into a separate file for each (active) major branch,Tom Lane2009-05-02
| | | | | | | | | | | | as per my recent proposal. release.sgml itself is now just a stub that should change rarely; ideally, only once per major release to add a new include line. Most editing work will occur in the release-N.N.sgml files. To update a back branch for a minor release, just copy the appropriate release-N.N.sgml file(s) into the back branch. This commit doesn't change the end-product documentation at all, only the source layout. However, it makes it easy to start omitting ancient information from newer branches' documentation, should we ever decide to do that.
* Update back-branch release notes.Tom Lane2009-03-12
|
* Update back-branch release notes.Tom Lane2009-01-30
|
* Update release notes for 8.3.5, 8.2.11, and 8.1.15 to mention the needBruce Momjian2009-01-09
| | | | | | | to reindex GiST indexes: If you were running a previous 8.X.X release, REINDEX all GiST indexes after the upgrade.
* Remove references to pgsql-ports and pgsql-patches mailing lists fromTom Lane2009-01-06
| | | | | various documentation, since those lists are now dead/deprecated. Point to pgsql-bugs and/or pgsql-hackers as appropriate.
* Update back-branch release notes.Tom Lane2008-10-30
|
* Install a more robust solution for the problem of infinite error-processingTom Lane2008-10-27
| | | | | | | | | | | | | recursion when we are unable to convert a localized error message to the client's encoding. We've been over this ground before, but as reported by Ibrar Ahmed, it still didn't work in the case of conversion failures for the conversion-failure message itself :-(. Fix by installing a "circuit breaker" that disables attempts to localize this message once we get into recursion trouble. Patch all supported branches, because it is in fact broken in all of them; though I had to add some missing translations to the older branches in order to expose the failure in the particular test case I was using.
* Fix COPY documentation to not imply that HEADER can be used outside CSV mode.Tom Lane2008-10-10
| | | | Per gripe from Bill Thoen.
* Update back-branch release notes.Tom Lane2008-09-19
|
* Fix pg_dump docs to acknowledge that you can use -Z with plain text output. ↵Tom Lane2008-08-26
| | | | Pointed out by Daniel Migowski.
* Update release notes for ALTER AGGREGATE fix.Tom Lane2008-06-08
|
* Update release notes for 8.3.3 et al.Tom Lane2008-06-07
|
* Remove link that pre-8.2 doc tools don't support.REL8_1_12Tom Lane2008-06-06
|
* Draft release notes for upcoming back-branch updates.Tom Lane2008-06-04
|
* Improve GRANT documentation to point out that UPDATE and DELETE typicallyTom Lane2008-05-28
| | | | | | require SELECT privilege as well, since you normally need to read existing column values within such commands. This behavior is according to spec, but we'd never documented it before. Per gripe from Volkan Yazici.
* Replace developer FAQ with a reference to the wiki, which is whereMagnus Hagander2008-04-22
| | | | it now lives (per discussion). Leave the other FAQs alone for now.
* Add link to major version release notes at the top of the minorMagnus Hagander2008-04-21
| | | | | | version ones, to make it clear to users just browsing the notes that there are a lot more changes available from whatever version they are at than what's in the minor version release notes.
* Fix LISTEN/NOTIFY race condition reported by Laurent Birtz, by postponingTom Lane2008-03-12
| | | | | | | | | | | | | | | | | | pg_listener modifications commanded by LISTEN and UNLISTEN until the end of the current transaction. This allows us to hold the ExclusiveLock on pg_listener until after commit, with no greater risk of deadlock than there was before. Aside from fixing the race condition, this gets rid of a truly ugly kludge that was there before, namely having to ignore HeapTupleBeingUpdated failures during NOTIFY. There is a small potential incompatibility, which is that if a transaction issues LISTEN or UNLISTEN and then looks into pg_listener before committing, it won't see any resulting row insertion or deletion, where before it would have. It seems unlikely that anyone would be depending on that, though. This patch also disallows LISTEN and UNLISTEN inside a prepared transaction. That case had some pretty undesirable properties already, such as possibly allowing pg_listener entries to be made for PIDs no longer present, so disallowing it seems like a better idea than trying to maintain the behavior.
* Fix an ancient oversight in libpq's handling of V3-protocol COPY OUT mode:Tom Lane2008-01-14
| | | | | | | we need to be able to swallow NOTICE messages, and potentially also ParameterStatus messages (although the latter would be a bit weird), without exiting COPY OUT state. Fix it, and adjust the protocol documentation to emphasize the need for this. Per off-list report from Alexander Galler.
* Update release notes for security releases.Tom Lane2008-01-03
| | | | Security: CVE-2007-4769, CVE-2007-4772, CVE-2007-6067, CVE-2007-6600, CVE-2007-6601
* Make standard maintenance operations (including VACUUM, ANALYZE, REINDEX,Tom Lane2008-01-03
| | | | | | | | | | | | | | | | | | | and CLUSTER) execute as the table owner rather than the calling user, using the same privilege-switching mechanism already used for SECURITY DEFINER functions. The purpose of this change is to ensure that user-defined functions used in index definitions cannot acquire the privileges of a superuser account that is performing routine maintenance. While a function used in an index is supposed to be IMMUTABLE and thus not able to do anything very interesting, there are several easy ways around that restriction; and even if we could plug them all, there would remain a risk of reading sensitive information and broadcasting it through a covert channel such as CPU usage. To prevent bypassing this security measure, execution of SET SESSION AUTHORIZATION and SET ROLE is now forbidden within a SECURITY DEFINER context. Thanks to Itagaki Takahiro for reporting this vulnerability. Security: CVE-2007-6600
* Fix invalid ipv6 address in example. Per doc comment 7211.Magnus Hagander2008-01-02
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-07 17:40:50 +0000