aboutsummaryrefslogtreecommitdiff
path: root/src/backend
Commit message (Collapse)AuthorAge
* Ensure that the result tuple of an EvalPlanQual cycle gets materializedTom Lane2009-12-11
| | | | | | | | before we zap the input tuple. Otherwise, pass-by-reference columns of the result slot are likely to contain just references to the input tuple, leading to big trouble if the pfree'd space is reused. Per trouble report from Jaime Casanova. This is a new bug in the recent rewrite of EvalPlanQual, so nothing to back-patch.
* Add large object access control.Itagaki Takahiro2009-12-11
| | | | | | | A new system catalog pg_largeobject_metadata manages ownership and access privileges of large objects. KaiGai Kohei, reviewed by Jaime Casanova.
* Add YAML to list of EXPLAIN formats. Greg Sabino Mullane, reviewed by ↵Andrew Dunstan2009-12-11
| | | | Takahiro Itagaki.
* Prevent indirect security attacks via changing session-local state withinTom Lane2009-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | an allegedly immutable index function. It was previously recognized that we had to prevent such a function from executing SET/RESET ROLE/SESSION AUTHORIZATION, or it could trivially obtain the privileges of the session user. However, since there is in general no privilege checking for changes of session-local state, it is also possible for such a function to change settings in a way that might subvert later operations in the same session. Examples include changing search_path to cause an unexpected function to be called, or replacing an existing prepared statement with another one that will execute a function of the attacker's choosing. The present patch secures VACUUM, ANALYZE, and CREATE INDEX/REINDEX against these threats, which are the same places previously deemed to need protection against the SET ROLE issue. GUC changes are still allowed, since there are many useful cases for that, but we prevent security problems by forcing a rollback of any GUC change after completing the operation. Other cases are handled by throwing an error if any change is attempted; these include temp table creation, closing a cursor, and creating or deleting a prepared statement. (In 7.4, the infrastructure to roll back GUC changes doesn't exist, so we settle for rejecting changes of "search_path" in these contexts.) Original report and patch by Gurjeet Singh, additional analysis by Tom Lane. Security: CVE-2009-4136
* Reject certificates with embedded NULLs in the commonName field. This stopsMagnus Hagander2009-12-09
| | | | | | | | | | | | | | | | | | attacks where an attacker would put <attack>\0<propername> in the field and trick the validation code that the certificate was for <attack>. This is a very low risk attack since it reuqires the attacker to trick the CA into issuing a certificate with an incorrect field, and the common PostgreSQL deployments are with private CAs, and not external ones. Also, default mode in 8.4 does not do any name validation, and is thus also not vulnerable - but the higher security modes are. Backpatch all the way. Even though versions 8.3.x and before didn't have certificate name validation support, they still exposed this field for the user to perform the validation in the application code, and there is no way to detect this problem through that API. Security: CVE-2009-4034
* Add exclusion constraints, which generalize the concept of uniqueness toTom Lane2009-12-07
| | | | | | | | support any indexable commutative operator, not just equality. Two rows violate the exclusion constraint if "row1.col OP row2.col" is TRUE for each of the columns in the constraint. Jeff Davis, reviewed by Robert Haas
* Speed up information schema privilege viewsPeter Eisentraut2009-12-05
| | | | | | | | | | | | | Instead of expensive cross joins to resolve the ACL, add table-returning function aclexplode() that expands the ACL into a useful form, and join against that. Also, implement the role_*_grants views as a thin layer over the respective *_privileges views instead of essentially repeating the same code twice. fixes bug #4596 by Joachim Wieland, with cleanup by me
* Fix bug in temporary file management with subtransactions. A cursor openedHeikki Linnakangas2009-12-03
| | | | | | | | | | | | | in a subtransaction stays open even if the subtransaction is aborted, so any temporary files related to it must stay alive as well. With the patch, we use ResourceOwners to track open temporary files and don't automatically close them at subtransaction end (though in the normal case temporary files are registered with the subtransaction resource owner and will therefore be closed). At end of top transaction, we still check that there's no temporary files marked as close-at-end-of-transaction open, but that's now just a debugging cross-check as the resource owner cleanup should've closed them already.
* Mark application_name as GUC_REPORT so that the value will be reported backTom Lane2009-12-02
| | | | | | | | to the client by the server. This might seem pretty pointless but apparently it will help pgbouncer, and perhaps other connection poolers. Anyway it's practically free to do so for the normal use-case where appname is only set in the startup packet --- we're just adding a few more bytes to the initial ParameterStatus response packet. Per comments from Marko Kreen.
* Teach the regular expression functions to do case-insensitive matching andTom Lane2009-12-01
| | | | | | | | | | | | | | | | | | | | locale-dependent character classification properly when the database encoding is UTF8. The previous coding worked okay in single-byte encodings, or in any case for ASCII characters, but failed entirely on multibyte characters. The fix assumes that the <wctype.h> functions use Unicode code points as the wchar representation for Unicode, ie, wchar matches pg_wchar. This is only a partial solution, since we're still stupid about non-ASCII characters in multibyte encodings other than UTF8. The practical effect of that is limited, however, since those cases are generally Far Eastern glyphs for which concepts like case-folding don't apply anyway. Certainly all or nearly all of the field reports of problems have been about UTF8. A more general solution would require switching to the platform's wchar representation for all regex operations; which is possible but would have substantial disadvantages. Let's try this and see if it's sufficient in practice.
* Revert due to Tom's concerns:Bruce Momjian2009-12-01
| | | | | Add ProcessUtility_hook() to handle all DDL to contrib/pg_stat_statements.
* ProcessUtility_hook:Bruce Momjian2009-12-01
| | | | | | Add ProcessUtility_hook() to handle all DDL to contrib/pg_stat_statements. Itagaki Takahiro
* Avoid core dump on empty thesaurus dictionary.Tom Lane2009-11-30
| | | | Per report from Robert Gravsjö.
* Make pg_stat_activity.application_name visible to all users, rather thanTom Lane2009-11-29
| | | | | being hidden when current_query is. Relocate it to a column position more consistent with that behavior. Per discussion.
* Add support for an application_name parameter, which is displayed inTom Lane2009-11-28
| | | | | | pg_stat_activity and recorded in log entries. Dave Page, reviewed by Andres Freund
* Eliminate a lot of list-management overhead within join_search_one_levelTom Lane2009-11-28
| | | | | | | | | | | | | | by adding a requirement that build_join_rel add new join RelOptInfos to the appropriate list immediately at creation. Per report from Robert Haas, the list_concat_unique_ptr() calls that this change eliminates were taking the lion's share of the runtime in larger join problems. This doesn't do anything to fix the fundamental combinatorial explosion in large join problems, but it should push out the threshold of pain a bit further. Note: because this changes the order in which joinrel lists are built, it might result in changes in selected plans in cases where different alternatives have exactly the same costs. There is one example in the regression tests.
* Fix an old bug in multixact and two-phase commit. Prepared transactions canHeikki Linnakangas2009-11-23
| | | | | | | | | | | | | be part of multixacts, so allocate a slot for each prepared transaction in the "oldest member" array in multixact.c. On PREPARE TRANSACTION, transfer the oldest member value from the current backends slot to the prepared xact slot. Also save and recover the value from the 2pc state file. The symptom of the bug was that after a transaction prepared, a shared lock still held by the prepared transaction was sometimes ignored by other transactions. Fix back to 8.1, where both 2PC and multixact were introduced.
* Remove superfluous curly brace, fixing compilation with OPTIMIZER_DEBUG.Heikki Linnakangas2009-11-22
| | | | Jan Urbanski
* Add a WHEN clause to CREATE TRIGGER, allowing a boolean expression to beTom Lane2009-11-20
| | | | | | | | | | | checked to determine whether the trigger should be fired. For BEFORE triggers this is mostly a matter of spec compliance; but for AFTER triggers it can provide a noticeable performance improvement, since queuing of a deferred trigger event and re-fetching of the row(s) at end of statement can be short-circuited if the trigger does not need to be fired. Takahiro Itagaki, reviewed by KaiGai Kohei.
* Fix memory leak in syslogger: logfile_rotate() would leak a copy of theTom Lane2009-11-19
| | | | | | | | | output filename if CSV logging was enabled and only one of the two possible output files got rotated during a particular call (which would, in fact, typically be the case during a size-based rotation). This would amount to about MAXPGPATH (1KB) per rotation, and it's been there since the CSV code was put in, so it's surprising that nobody noticed it before. Per bug #5196 from Thomas Poindessous.
* Add a hook to CREATE/ALTER ROLE to allow an external module to check theTom Lane2009-11-18
| | | | | | | strength of database passwords, and create a sample implementation of such a hook as a new contrib module "passwordcheck". Laurenz Albe, reviewed by Takahiro Itagaki
* Provide a parenthesized-options syntax for VACUUM, analogous to that recentlyTom Lane2009-11-16
| | | | | | | | adopted for EXPLAIN. This will allow additional options to be implemented in future without having to make them fully-reserved keywords. The old syntax remains available for existing options, however. Itagaki Takahiro
* While doing the final setrefs.c pass over a plan tree, try to match upTom Lane2009-11-16
| | | | | | | | | | | | | | | non-Var sort/group expressions using ressortgroupref labels instead of depending entirely on equal()-ity of the upper node's tlist expressions to the lower node's. This avoids emitting the wrong outputs in cases where there are textually identical volatile sort/group expressions, as for example select distinct random(),random() from generate_series(1,10); Per report from Andrew Gierth. Backpatch to 8.4. Arguably this is wrong all the way back, but the only known case where there's an observable problem is when using hash aggregation to implement DISTINCT, which is new as of 8.4. So for the moment I'll refrain from backpatching further.
* Make text search parser accept underscores in XML attributes (bug #5075)Peter Eisentraut2009-11-15
|
* Improve planning of Materialize nodes inserted atop the inner input of aTom Lane2009-11-15
| | | | | | | | | mergejoin to shield it from doing mark/restore and refetches. Put an explicit flag in MergePath so we can centralize the logic that knows about this, and add costing logic that considers using Materialize even when it's not forced by the previously-existing considerations. This is in response to a discussion back in August that suggested that materializing an inner indexscan can be helpful when the refetch percentage is high enough.
* Clean up a couple of bizarre code formatting choices in recent CREATE LIKE ↵Tom Lane2009-11-13
| | | | patch.
* A better fix for the "ARRAY[...]::domain" problem. The previous patch worked,Heikki Linnakangas2009-11-13
| | | | | | | but the transformed ArrayExpr claimed to have a return type of "domain", even though the domain constraint was only checked by the enclosing CoerceToDomain node. With this fix, the ArrayExpr is correctly labeled with the base type of the domain. Per gripe by Tom Lane.
* When you do "ARRAY[...]::domain", where domain is a domain over an array type,Heikki Linnakangas2009-11-13
| | | | | | | | | we need to check domain constraints. We used to do it correctly, but 8.4 introduced a separate code path for the "ARRAY[]::arraytype" case to infer the type of an empty ARRAY construct from the cast target, and forgot to take domains into account. Per report from Florian G. Pflug.
* Fix multicolumn GIN's wrong results with fastupdate enabled.Teodor Sigaev2009-11-13
| | | | | | | | User-defined consistent functions believes the check array contains at least one true element which was not a true for scanning pending list. Per report from Yury Don <yura@vpcit.ru>
* The recent patch to log changes in postgresql.conf settings dumped coreTom Lane2009-11-12
| | | | | if the initial value of a string variable was NULL, which is entirely possible. Noted while experimenting with custom_variable_classes.
* Make initdb behave sanely when the selected locale has codeset "US-ASCII".Tom Lane2009-11-12
| | | | | | | | | | | | | | Per discussion, this should result in defaulting to SQL_ASCII encoding. The original coding could not support that because it conflated selection of SQL_ASCII encoding with not being able to determine the encoding. Adjust pg_get_encoding_from_locale()'s API to distinguish these cases, and fix callers appropriately. Only initdb actually changes behavior, since the other callers were perfectly content to consider these cases equivalent. Per bug #5178 from Boh Yap. Not going to bother back-patching, since no one has complained before and there's an easy workaround (namely, specify the encoding you want).
* Remove pg_parse_string_token() --- not needed anymore.Tom Lane2009-11-12
|
* Remove plpgsql's separate lexer (finally!), in favor of using the core lexerTom Lane2009-11-12
| | | | | | | directly. This was a lot of trouble, but should be worth it in terms of not having to keep the plpgsql lexer in step with core anymore. In addition the handling of keywords is significantly better-structured, allowing us to de-reserve a number of words that plpgsql formerly treated as reserved.
* Change "name" nonterminal in cursor-related productions to cursor_name.Alvaro Herrera2009-11-11
| | | | | | | This is a preparatory patch for allowing a dynamic cursor name be used in the ECPG grammar. Author: Zoltan Boszormenyi
* Support optional FROM/IN in FETCH and MOVEAlvaro Herrera2009-11-11
| | | | | | | | | | The main motivation for this is that it's required for Informix compatibility in ECPG. This patch makes the ECPG and core grammars a bit closer to one another for these productions. Author: Zoltan Boszormenyi
* Revert the temporary patch to work around Snow Leopard readdir() bug.Tom Lane2009-11-10
| | | | | | | | Apple has fixed that bug in 10.6.2, and we should encourage users to update to that version rather than trusting this cosmetic patch. As was recently noted by Stephen Tyler, this patch was only masking the problem in the context of DROP TABLESPACE, but the failure could occur in other places such as pg_xlog cleanup.
* interval_abs():Bruce Momjian2009-11-10
| | | | | | | | Add C comment about why there is no interval_abs(): it is unclear what value to return: http://archives.postgresql.org/pgsql-general/2009-10/msg01031.php http://archives.postgresql.org/pgsql-general/2009-11/msg00041.php
* Fix longstanding problems in VACUUM caused by untimely interruptionsAlvaro Herrera2009-11-10
| | | | | | | | | | | | | | | | | | | | In VACUUM FULL, an interrupt after the initial transaction has been recorded as committed can cause postmaster to restart with the following error message: PANIC: cannot abort transaction NNNN, it was already committed This problem has been reported many times. In lazy VACUUM, an interrupt after the table has been truncated by lazy_truncate_heap causes other backends' relcache to still point to the removed pages; this can cause future INSERT and UPDATE queries to error out with the following error message: could not read block XX of relation 1663/NNN/MMMM: read only 0 of 8192 bytes The window to this race condition is extremely narrow, but it has been seen in the wild involving a cancelled autovacuum process. The solution for both problems is to inhibit interrupts in both operations until after the respective transactions have been committed. It's not a complete solution, because the transaction could theoretically be aborted by some other error, but at least fixes the most common causes of both problems.
* Re-refactor the core scanner's API, in order to get out from under the problemTom Lane2009-11-09
| | | | | | | | | | | | | | | | | | of different parsers having different YYSTYPE unions that they want to use with it. I defined a new union core_YYSTYPE that is just the (very short) list of semantic values returned by the core scanner. I had originally worried that this would require an extra interface layer, but actually we can have parser.c's base_yylex (formerly filtered_base_yylex) take care of that at no extra cost. Names associated with the core scanner are now "core_yy_foo", with "base_yy_foo" being used in the core Bison parser and the parser.c interface layer. This solves the last serious stumbling block to eliminating plpgsql's separate lexer. One restriction that will still be present is that plpgsql and the core will have to agree on the token numbers assigned to tokens that can be returned by the core lexer. Since Bison doesn't seem willing to accept external assignments of those numbers, we'll have to live with decreeing that core and plpgsql grammars declare these tokens first and in the same order.
* Fix WHERE CURRENT OF to work as designed within plpgsql. The argumentTom Lane2009-11-09
| | | | | | | can be the name of a plpgsql cursor variable, which formerly was converted to $N before the core parser saw it, but that's no longer the case. Deal with plain name references to plpgsql variables, and add a regression test case that exposes the failure.
* Keep track of language's trusted flag in InlineCodeBlock. Needed to support ↵Andrew Dunstan2009-11-06
| | | | DO blocks for languages that have both trusted and untrusted variants.
* Don't treat NEW and OLD as reserved words anymore. For the purposes of rulesTom Lane2009-11-05
| | | | | | | | it works just as well to have them be ordinary identifiers, and this gets rid of a number of ugly special cases. Plus we aren't interfering with non-rule usage of these names. catversion bump because the names change internally in stored rules.
* reenable -> re-enablePeter Eisentraut2009-11-05
| | | | Pointed out by Debian's lintian.
* Allow binary-coercible cases in ri_HashCompareOp; there are some such casesTom Lane2009-11-05
| | | | | | that are not handled by find_coercion_pathway, notably composite->RECORD. Now that 8.4 supports composites as primary keys, it's worth dealing with this case.
* Rename some encoding conversion modules to keep pathnames in our sourceTom Lane2009-11-04
| | | | | | | tarballs under 100 characters. This should avoid failures with certain untarring tools (WinZip and Midnight Commander have been mentioned as likely suspects). Per my proposal of yesterday. catversion bumped since the initial contents of pg_proc change.
* Make expression locations for LIKE and SIMILAR TO constructs uniformly pointTom Lane2009-11-04
| | | | | | at the first keyword of the expression, rather than drawing a rather artificial distinction between the ESCAPE subclause and the rest. Per gripe from Gokulakannan Somasundaram and subsequent discusssion.
* Add support for invoking parser callback hooks via SPI and in cached plans.Tom Lane2009-11-04
| | | | | | | | | | | | As proof of concept, modify plpgsql to use the hooks. plpgsql is still inserting $n symbols textually, but the "back end" of the parsing process now goes through the ParamRef hook instead of using a fixed parameter-type array, and then execution only fetches actually-referenced parameters, using a hook added to ParamListInfo. Although there's a lot left to be done in plpgsql, this already cures the "if (TG_OP = 'INSERT' and NEW.foo ...)" problem, as illustrated by the changed regression test.
* Allow rewriting ALTER TABLE to skip WAL logging.Heikki Linnakangas2009-11-04
| | | | Itagaki Takahiro, with small changes by me and Simon.
* Dept of second thoughts: after studying index_getnext() a bit more I realizeTom Lane2009-11-01
| | | | | | that it can scribble on scan->xs_ctup.t_self while following HOT chains, so we can't rely on that to stay valid between hashgettuple() calls. Introduce a private variable in HashScanOpaque, instead.
* Fix two serious bugs introduced into hash indexes by the 8.4 patch that madeTom Lane2009-11-01
| | | | | | | | | | | | | | | | | | | | | | | | hash indexes keep entries sorted by hash value. First, the original plans for concurrency assumed that insertions would happen only at the end of a page, which is no longer true; this could cause scans to transiently fail to find index entries in the presence of concurrent insertions. We can compensate by teaching scans to re-find their position after re-acquiring read locks. Second, neither the bucket split nor the bucket compaction logic had been fixed to preserve hashvalue ordering, so application of either of those processes could lead to permanent corruption of an index, in the sense that searches might fail to find entries that are present. This patch fixes the split and compaction logic to preserve hashvalue ordering, but it cannot do anything about pre-existing corruption. We will need to recommend reindexing all hash indexes in the 8.4.2 release notes. To buy back the performance loss hereby induced in split and compaction, fix them to use PageIndexMultiDelete instead of retail PageIndexDelete operations. We might later want to do something with qsort'ing the page contents rather than doing a binary search for each insertion, but that seemed more invasive than I cared to risk in a back-patch. Per bug #5157 from Jeff Janes and subsequent investigation.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-06 19:38:21 +0000