On Mon, Jul 23, 2007 at 10:59:17AM -0300, Thiago Maluf wrote: > I have one database server with postgresql 8.1 and I discovered yesterday > one security problem. > When I access my server with thought psql I have the possibility execute > command in my server using "\!" or write one file using "\e". > I want disable these options in my server but I searched it and not found.
These psql commands run on the client with the privileges of the client; they don't allow the client to do anything it couldn't already do from the shell, and presumably the client already has access to the shell if it's running psql. This would be a security problem if you use psql to run SQL statements from an untrusted source, but if you're doing that then you already have a security problem. -- Michael Fuhr ---------------------------(end of broadcast)--------------------------- TIP 7: You can help support the PostgreSQL project by donating at http://www.postgresql.org/about/donate