Re: [HACKERS] [PROPOSAL] Client Log Output Filtering

[David Steele]

On 3/10/16 11:00 AM, Petr Jelinek wrote:

> The comment above errhidefromclient says "Only log levels below ERROR
> can be hidden from the client." but use of the errhidefromclient(true)
> actually does hide the error message from client, client just gets
> failed query without any message when used with ERROR level.

Right you are.  The v3 patch adds this check.

I also added the documentation to sources.sgml that Tom pointed out was
missing.

Thanks,
-- 
-David
da...@pgmasters.net

diff --git a/doc/src/sgml/sources.sgml b/doc/src/sgml/sources.sgml
index fcb3e40..4ad15d0 100644
--- a/doc/src/sgml/sources.sgml
+++ b/doc/src/sgml/sources.sgml
@@ -353,6 +353,14 @@ ereport(ERROR,
      includes the current statement already.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     <function>errhidefromclient(bool hide_from_client)</function> can be
+     called to suppress message output to the client when the error severity
+     level is lower than <literal>ERROR</>.  It is useful for hiding sensitive
+     messages from the client while still logging them on the server.
+    </para>
+   </listitem>
   </itemizedlist>
    </para>
 
diff --git a/src/backend/utils/error/elog.c b/src/backend/utils/error/elog.c
index 5b7554b..5e5035d 100644
--- a/src/backend/utils/error/elog.c
+++ b/src/backend/utils/error/elog.c
@@ -1094,6 +1094,22 @@ errhidecontext(bool hide_ctx)
        return 0;                                       /* return value does 
not matter */
 }
 
+/*
+ * errhidefromclient --- optionally suppress output of message to client
+ * if error severity level < ERROR.
+ */
+int
+errhidefromclient(bool hide_from_client)
+{
+       ErrorData  *edata = &errordata[errordata_stack_depth];
+
+       /* we don't bother incrementing recursion_depth */
+       CHECK_STACK_DEPTH();
+
+       edata->hide_from_client = hide_from_client && edata->elevel < ERROR;
+
+       return 0;                                       /* return value does 
not matter */
+}
 
 /*
  * errfunction --- add reporting function name to the current error
@@ -1477,7 +1493,7 @@ EmitErrorReport(void)
                send_message_to_server_log(edata);
 
        /* Send to client, if enabled */
-       if (edata->output_to_client)
+       if (edata->output_to_client && !edata->hide_from_client)
                send_message_to_frontend(edata);
 
        MemoryContextSwitchTo(oldcontext);
diff --git a/src/include/utils/elog.h b/src/include/utils/elog.h
index 7d338dd..05dfe2b 100644
--- a/src/include/utils/elog.h
+++ b/src/include/utils/elog.h
@@ -179,6 +179,7 @@ extern int  errcontext_msg(const char *fmt,...) 
pg_attribute_printf(1, 2);
 
 extern int     errhidestmt(bool hide_stmt);
 extern int     errhidecontext(bool hide_ctx);
+extern int     errhidefromclient(bool hide_from_client);
 
 extern int     errfunction(const char *funcname);
 extern int     errposition(int cursorpos);
@@ -343,6 +344,7 @@ typedef struct ErrorData
        bool            show_funcname;  /* true to force funcname inclusion */
        bool            hide_stmt;              /* true to prevent STATEMENT: 
inclusion */
        bool            hide_ctx;               /* true to prevent CONTEXT: 
inclusion */
+       bool            hide_from_client;       /* true to prevent client 
output */
        const char *filename;           /* __FILE__ of ereport() call */
        int                     lineno;                 /* __LINE__ of 
ereport() call */
        const char *funcname;           /* __func__ of ereport() call */

signature.asc
Description: OpenPGP digital signature