On Wed, Apr 03, 2024 at 06:11:47PM -0700, David G. Johnston wrote:
> On Sat, Mar 30, 2024 at 11:16 PM Noah Misch wrote:
> > On Tue, Jan 30, 2024 at 01:49:42PM -0700, David G. Johnston wrote:
> > > + The membership grants created by the
> > > + IN ROLE, ROLE, and
On Tue, Jan 30, 2024 at 01:49:42PM -0700, David G. Johnston wrote:
> + The membership grants created by the
> + IN ROLE, ROLE, and
> ADMIN
> + clauses have the role executing this command as the grantee.
This should be s/grantee/grantor/, right?
> + If unspecified when create a new role
On Fri, Oct 07, 2022 at 09:35:49AM -0400, Bruce Momjian wrote:
> On Fri, Oct 7, 2022 at 08:05:36AM +, Erki Eessaar wrote:
> > I confirmed, that setting search_path is indeed sometimes needed in case of
> > SECURITY DEFINER routines that have SQL-standard bodies. See an example at
> > the
> >
On Thu, Sep 08, 2022 at 01:20:31PM +0200, Peter Eisentraut wrote:
> On 01.09.22 03:11, Bruce Momjian wrote:
> >On Tue, Aug 16, 2022 at 03:38:13PM -0400, Bruce Momjian wrote:
> >>On Tue, Aug 16, 2022 at 03:34:22PM -0400, Tom Lane wrote:
> >>>Bruce Momjian writes:
> I have written the attached p
On Sat, Oct 12, 2019 at 06:35:12PM -0700, Noah Misch wrote:
> When I updated
> https://www.postgresql.org/docs/devel/ddl-schemas.html#DDL-SCHEMAS-PATTERNS
> for CVE-2018-1058, I wrote that some schema usage patterns are secure against
> CREATEROLE users and database owners. That w
When I updated
https://www.postgresql.org/docs/devel/ddl-schemas.html#DDL-SCHEMAS-PATTERNS
for CVE-2018-1058, I wrote that some schema usage patterns are secure against
CREATEROLE users and database owners. That was incorrect. Even with the
first pattern, a database owner can attack the database'
On Sat, Apr 06, 2019 at 11:35:44AM +0200, Magnus Hagander wrote:
> On Fri, Apr 5, 2019 at 10:58 PM Peter Eisentraut
> wrote:
> > On 2019-04-05 18:11, Jonathan S. Katz wrote:
> > > (There could be an additional discussion about whether or not we want to
> > > change the default behavior for initdb
The CVE-2018-1058 documentation change, commit 5770172, directed readers to
secure their schema usage patterns. That made secure their use of unqualified
function and operator names. Sometimes one wishes to call an object outside
search_path via a qualified name. That has its own security consid
