| Commit message (Collapse) | Author | Age |
|
|
|
| |
Security: CVE-2012-0866, CVE-2012-0867, CVE-2012-0868
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This check was overlooked when we added function execute permissions to the
system years ago. For an ordinary trigger function it's not a big deal,
since trigger functions execute with the permissions of the table owner,
so they couldn't do anything the user issuing the CREATE TRIGGER couldn't
have done anyway. However, if a trigger function is SECURITY DEFINER,
that is not the case. The lack of checking would allow another user to
install it on his own table and then invoke it with, essentially, forged
input data; which the trigger function is unlikely to realize, so it might
do something undesirable, for instance insert false entries in an audit log
table.
Reported by Dinesh Kumar, patch by Robert Haas
Security: CVE-2012-0866
|
| |
|
|
|
|
|
| |
The sort order is no longer fixed at database creation time, but can be
controlled via COLLATE. Noted by Thomas Kellerer.
|
| |
|
| |
|
|
|
|
| |
Spotted by Koizumi Satoru.
|
| |
|
|
|
|
| |
Euler Taveira de Oliveira
|
|
|
|
| |
preserve pg_class oids since PG 9.0.
|
|
|
|
|
|
| |
PGresults used to be read-only from the application's viewpoint, but now
that we've exposed various functions that allow modification of a PGresult,
that sweeping statement is no longer accurate. Noted by Dmitriy Igrishin.
|
|
|
|
|
| |
The point that you need parentheses for non-constant expressions apparently
needs to be brought out a bit more clearly, per bug #6315.
|
|
|
|
| |
Per Emmanuel Kasper, sysctl works fine as of NetBSD 5.0.
|
| |
|
|
|
|
|
|
|
|
|
| |
The correct information appears in the text, so just remove the statement
in the table, where it did not fit nicely anyway. (Curiously, the correct
info has been there much longer than the erroneous table entry.)
Resolves problem noted by Daniele Varrazzo.
In HEAD and 9.1, also do a bit of wordsmithing on other text on the page.
|
| |
|
|
|
|
|
|
| |
Backpatch to 9.1.
Mark Hills
|
| |
|
|
|
|
|
| |
The given archive_command example didn't use %p or %f, which wouldn't
really work in practice.
|
| |
|
|
|
|
| |
Kevin Grittner
|
|
|
|
| |
Report by Vik Reykja, patch by Kevin Grittner.
|
|
|
|
|
| |
expect -> except, noted by Andrew Dunstan. Also, "cannot" seems more
readable here than "can not", per David Wheeler.
|
| |
|
|
|
|
| |
Fujii Masao
|
| |
|
|
|
|
|
|
| |
dummy_label -> dummy_seclabel
Thom Brown
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We have seen one too many reports of people trying to use 9.1 extension
files in the old-fashioned way of sourcing them in psql. Not only does
that usually not work (due to failure to substitute for MODULE_PATHNAME
and/or @extschema@), but if it did work they'd get a collection of loose
objects not an extension. To prevent this, insert an \echo ... \quit
line that prints a suitable error message into each extension script file,
and teach commands/extension.c to ignore lines starting with \echo.
That should not only prevent any adverse consequences of loading a script
file the wrong way, but make it crystal clear to users that they need to
do it differently now.
Tom Lane, following an idea of Andrew Dunstan's. Back-patch into 9.1
... there is not going to be much value in this if we wait till 9.2.
|
| |
|
|
|
|
|
|
| |
The documentation neglected to explain its behavior in a script file
(it only ends execution of the script, not psql as a whole), and failed
to mention the long form \quit either.
|
|
|
|
| |
Backpatch to 9.0.X and 9.1.X.
|
|
|
|
|
|
| |
help prevent pg_ctl from getting confused.
Backpatch to 9.1.
|
|
|
|
| |
Per suggestions from Achilleas Mantzios and Greg Smith.
|
|
|
|
| |
Shigehiro Honda
|
|
|
|
| |
Dickson S. Guedes
|
|
|
|
|
| |
Back-port the new "test_sepgsql" script into 9.1 to provide a substitute
test mechanism.
|
| |
|
|
|
|
|
|
|
|
| |
This mode still exists for backwards compatibility, making
sslmode=require the same as sslmode=verify-ca when the file is present,
but not causing an error when it isn't.
Per bug 6189, reported by Srinivas Aji
|
|
|
|
| |
Jaime Casanova
|
|
|
|
| |
Man, we fixed a lotta bugs since April.
|
|
|
|
|
|
| |
REPLICATION privileges, not SUPERUSER.
Fujii Masao
|
|
|
|
| |
Also set the documented release date to 2011-09-12.
|
|
|
|
|
|
|
|
| |
because its internal format was changed in 8.4.
Backpatch to 9.0 and 9.1.
Report by depesz, diagnosis by Tom.
|
|
|
|
|
|
| |
Backpatch to 9.0 and 9.1.
Patch from Josh Kupershmidt.
|
|
|
|
|
|
|
|
| |
fields.
Backpatch to 9.0 and 9.1.
Report from Pavel Stehule, patch from Josh Kupershmidt
|
|
|
|
| |
Per Peter.
|
|
|
|
|
|
| |
pgpass.
Backpatch to 9.1.
|
|
|
|
| |
Backpatch to 9.0 and 9.1.
|
|
|
|
|
|
| |
Backpatch to 9.0 and 9.1.
Report from depstein@alliedtesting.com.
|
|
|
|
|
|
| |
We've now seen more than one gripe from somebody who didn't get the memo
about how to install contrib modules in 9.1. Try to make it a little more
prominent that you aren't supposed to call the scripts directly anymore.
|