Re: [GENERAL] Running untrusted sql safely?

2009-02-15 Thread Tino Wildenhain
Scott Marlowe wrote: On Sun, Feb 15, 2009 at 4:39 PM, Christophe wrote: On Feb 15, 2009, at 2:47 PM, Stuart McGraw wrote: I just hoping for some confirmation that the permissions based approach did not have some holes in it that I am not seeing. Another possibility is to create a set of func

Re: [GENERAL] Check for an empty result

2009-02-15 Thread Eus
Hi Andreas! --- On Fri, 2/13/09, A. Kretschmer wrote: > In response to Eus : > > Hi Ho! > > > > Is there a way to check whether or not a subquery > returns an empty result set? > > You can use EXISTS for that: > > -- empty result > test=*# select * from (select 1 where 1=2) foo; > ?column? >

Re: [GENERAL] Check for an empty result

2009-02-15 Thread Eus
Hi Craig! --- On Fri, 2/13/09, Craig Ringer wrote: > Eus wrote: > > Hi Ho! > > > > Is there a way to check whether or not a subquery > returns an empty result set? > > "EXISTS" > > SELECT blah FROM blah WHERE EXISTS (SELECT 1 FROM tablename > WHERE ...); Thank you. Previously I tried: "... W

Re: [GENERAL] Running untrusted sql safely?

2009-02-15 Thread Scott Marlowe
On Sun, Feb 15, 2009 at 4:39 PM, Christophe wrote: > > On Feb 15, 2009, at 2:47 PM, Stuart McGraw wrote: > >> I just hoping for some confirmation that the permissions based approach >> did not have some holes in it that I am >> not seeing. > > Another possibility is to create a set of functions th

Re: [GENERAL] Attempting to connect

2009-02-15 Thread Scott Marlowe
Woohoo! Glad you got it working... -- Sent via pgsql-general mailing list (pgsql-general@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-general

Re: [GENERAL] Running untrusted sql safely?

2009-02-15 Thread Christophe
On Feb 15, 2009, at 2:47 PM, Stuart McGraw wrote: I just hoping for some confirmation that the permissions based approach did not have some holes in it that I am not seeing. Another possibility is to create a set of functions that contain the query operations you would like to allow, isol

Re: [GENERAL] Attempting to connect

2009-02-15 Thread Bob Pawley
Finally Success Thanks everyone Bob - Original Message - From: "John R Pierce" To: "Bob Pawley" Cc: "PostgreSQL" Sent: Sunday, February 15, 2009 3:05 PM Subject: Re: [GENERAL] Attempting to connect # IPv4 local connections: host all all

Re: [GENERAL] Running untrusted sql safely?

2009-02-15 Thread Stuart McGraw
Scott Marlowe wrote: On Sun, Feb 15, 2009 at 3:09 PM, Stuart McGraw wrote: John R Pierce wrote: Stuart McGraw wrote: What is the best way to run an arbitrary query received from an untrusted source, safely? (I want a web page form with a textbox that a user can enter an arbitrary sql statem

Re: [GENERAL] Attempting to connect

2009-02-15 Thread John R Pierce
# IPv4 local connections: host all all 0.0.0.0 255.255.255.255 md5 host all all127.0.0.1/32 md5 oh. that first HOST line will only allow IP 0.0.0.0, hardly likely to be a valid address. if

Re: [GENERAL] Attempting to connect

2009-02-15 Thread Adrian Klaver
On Sunday 15 February 2009 2:19:13 pm Adrian Klaver wrote: > On Sunday 15 February 2009 1:41:14 pm Bob Pawley wrote: > > Hi > > > > I do need some help here. > > > > I am still having trouble making a remote connection. The 'Server doesn't > > listen' message comes up. > > > > The config files have

Re: [GENERAL] Attempting to connect

2009-02-15 Thread Scott Marlowe
On Sun, Feb 15, 2009 at 3:29 PM, Bob Pawley wrote: > The log file states "parameter "listen-adress" cannot be changed after > server start; conf change ignored. > > I am getting this log entry after saving the file and reloading with the > server shutdown. > > Does anyone have a procedure for maki

Re: [GENERAL] Attempting to connect

2009-02-15 Thread Bob Pawley
The log file states "parameter "listen-adress" cannot be changed after server start; conf change ignored. I am getting this log entry after saving the file and reloading with the server shutdown. Does anyone have a procedure for making changes to this file? Bob - Original Message -

Re: [GENERAL] Running untrusted sql safely?

2009-02-15 Thread Scott Marlowe
On Sun, Feb 15, 2009 at 3:09 PM, Stuart McGraw wrote: > John R Pierce wrote: >> >> Stuart McGraw wrote: >>> >>> What is the best way to run an arbitrary query received from an untrusted >>> source, safely? >>> (I want a web page form with a textbox that >>> a user can enter an arbitrary sql statem

Re: [GENERAL] Array in nested query

2009-02-15 Thread Ken Winter
Thanks, Osvaldo and Fernando - your solution works! > -Original Message- > From: Osvaldo Kussama [mailto:osvaldo.kuss...@gmail.com] > Sent: Saturday, February 14, 2009 8:24 PM > To: Ken Winter > Subject: Re: [GENERAL] Array in nested query > > 2009/2/14 Ken Winter : > > I'm trying to look

Re: [GENERAL] pg_hba reload

2009-02-15 Thread Lennin Caro
--- On Sat, 2/14/09, Bob Pawley wrote: > From: Bob Pawley > Subject: Re: [GENERAL] pg_hba reload > To: "John R Pierce" , "PostgreSQL" > > Date: Saturday, February 14, 2009, 11:31 PM > I'm running 8.3 on Windows XP. > > I input > pg_ctl reload -D c:\program > files\postgresql\8.3\data- or

Re: [GENERAL] Attempting to connect

2009-02-15 Thread Adrian Klaver
On Sunday 15 February 2009 1:41:14 pm Bob Pawley wrote: > Hi > > I do need some help here. > > I am still having trouble making a remote connection. The 'Server doesn't > listen' message comes up. > > The config files have been changed as shown below. > > Postgresql.conf > > #listen_addresses = '*'

Re: [GENERAL] Running untrusted sql safely?

2009-02-15 Thread Stuart McGraw
John R Pierce wrote: Stuart McGraw wrote: What is the best way to run an arbitrary query received from an untrusted source, safely? (I want a web page form with a textbox that a user can enter an arbitrary sql statement, then run it . just keep http://xkcd.com/327/ in mind. Yes, exa

Re: [GENERAL] Attempting to connect

2009-02-15 Thread Bob Pawley
Removed # Reloaded postmaster, restarted server. Server still isn't listening. Bob - Original Message - From: "John R Pierce" To: "Bob Pawley" ; Sent: Sunday, February 15, 2009 1:44 PM Subject: Re: [GENERAL] Attempting to connect Bob Pawley wrote: Hi I do need some help here.

Re: [GENERAL] Attempting to connect

2009-02-15 Thread John R Pierce
Bob Pawley wrote: Hi I do need some help here. I am still having trouble making a remote connection. The 'Server doesn't listen' message comes up. The config files have been changed as shown below. Postgresql.conf #listen_addresses = '*' you'd need to remove that # (comment) from the fr

[GENERAL] Attempting to connect

2009-02-15 Thread Bob Pawley
Hi I do need some help here. I am still having trouble making a remote connection. The 'Server doesn't listen' message comes up. The config files have been changed as shown below. Postgresql.conf #listen_addresses = '*' pg_hba # TYPE DATABASE USER CIDR-ADDRESs IP-Mask

Re: [GENERAL] Running untrusted sql safely?

2009-02-15 Thread John R Pierce
Stuart McGraw wrote: What is the best way to run an arbitrary query received from an untrusted source, safely? (I want a web page form with a textbox that a user can enter an arbitrary sql statement, then run it . just keep http://xkcd.com/327/ in mind. -- Sent via pgsql-general

[GENERAL] Running untrusted sql safely?

2009-02-15 Thread Stuart McGraw
What is the best way to run an arbitrary query received from an untrusted source, safely? (I want a web page form with a textbox that a user can enter an arbitrary sql statement, then run it but I want to prevent therm from changing anything or escaping postgresql and executing system comman

Re: [GENERAL] partial unique index and the planner

2009-02-15 Thread Tom Lane
Michal Politowski writes: > Is it normal that plans using a scan on a partial unique index > estimate that much more than one row is returned? There isn't currently any special logic to recognize that case; the estimate is just whatever is going to come out of the normal statistics-based estimati

Re: [GENERAL] partial unique index and the planner

2009-02-15 Thread Scott Marlowe
2009/2/15 Michal Politowski : > I'm using PostgreSQL 8.3. > Is it normal that plans using a scan on a partial unique index > estimate that much more than one row is returned? > > Eg. I see: > -> Bitmap Index Scan on tmp_idx_oss_archive_object_id_current > (cost=0.00..3.12 rows=4189 width=0) > wh

[GENERAL] partial unique index and the planner

2009-02-15 Thread Michal Politowski
I'm using PostgreSQL 8.3. Is it normal that plans using a scan on a partial unique index estimate that much more than one row is returned? Eg. I see: -> Bitmap Index Scan on tmp_idx_oss_archive_object_id_current (cost=0.00..3.12 rows=4189 width=0) where the tmp_idx_oss_archive_object_id_current

Re: [GENERAL] How do I set the schema search path in a datasource config for a connection pool?

2009-02-15 Thread Bjørn T Johansen
On Sun, 15 Feb 2009 08:47:36 -0700 Scott Marlowe wrote: > On Sun, Feb 15, 2009 at 5:58 AM, Bjørn T Johansen wrote: > > I can't find a way to do this, what am I missing? > > You can either issue the command when you open the connection, alter > the user the connection uses, or alter the database

Re: [GENERAL] How do I set the schema search path in a datasource config for a connection pool?

2009-02-15 Thread Scott Marlowe
On Sun, Feb 15, 2009 at 5:58 AM, Bjørn T Johansen wrote: > I can't find a way to do this, what am I missing? You can either issue the command when you open the connection, alter the user the connection uses, or alter the database to default to that search path. alter user bubba set search_path='

Re: [GENERAL] Array in nested query

2009-02-15 Thread Osvaldo Kussama
2009/2/15 Fernando Moreno : > What error are you getting? > > I tried your query and I had to add an explicit cast to smallint[] to > make it work. Like this: > > ... a.attnum = any ((select conkey FROM pg_catalog.pg_constraint WHERE >> oid = 3708025)::smallint[]); > > It seems strange to me, I did

Re: [GENERAL] currval() in insert statements

2009-02-15 Thread Craig Ringer
Onno Molenkamp wrote: > Hi, > > I recently upgraded a database from 8.1.11 to 8.3.6, and I noticed the > following statement stopped working: > > insert into test (b) select currval('test_a_seq'::regclass) It's generally a REALLY bad idea to mix `nextval' and `currval' use on the same sequenc

[GENERAL] How do I set the schema search path in a datasource config for a connection pool?

2009-02-15 Thread Bjørn T Johansen
I can't find a way to do this, what am I missing? Regards, BTJ -- --- Bjørn T Johansen b...@havleik.no --- So

Re: [GENERAL] select max from subquery

2009-02-15 Thread searchelite
Oleg Bartunov wrote: > > yOn Sat, 14 Feb 2009, searchelite wrote: > >> >> Dear All >> >> i gave this kind of query >> >> select max(foo) from (select some statement) as foo >> >> but it gave me this error >> ERROR: function max(record) does not exist >> >> >> any help how i can select max val

Re: [GENERAL] Array in nested query

2009-02-15 Thread Gerhard Heift
On Sat, Feb 14, 2009 at 05:36:11PM -0500, Ken Winter wrote: >I'm trying to look up the columns in a constraint in pg_catalog (of >PostgreSQL 8.0.x). I can't figure out how to "join" the elements of the >array that lists the `attnum's of the columns in the table to the `conkey' >arr

Re: [GENERAL] Slow update

2009-02-15 Thread Herouth Maoz
Alban Hertroys wrote: > On Feb 9, 2009, at 2:07 PM, Grzegorz Jaśkiewicz wrote: > >> On Mon, Feb 9, 2009 at 12:50 PM, Herouth Maoz >> wrote: >>> I hope someone can clue me in based on the results of explain analyze. >> >> Did you have a chance to run vmstat on it, and post it here ? Maybe - >> if d