Re: Isn't pg_statistic a security hole? - Mailing list pgsql-hackers

From Joe Conway
Subject Re: Isn't pg_statistic a security hole?
Date
Msg-id 014001c0d667$68ff9610$0205a8c0@jecw2k1
Whole thread Raw
In response to Re: Isn't pg_statistic a security hole?  (Stephan Szabo <sszabo@megazone23.bigpanda.com>)
List pgsql-hackers
> Hmm, that would work --- you could join against pg_class to find out the
> owner of the relation.  While you were at it, maybe look up the
> attribute name in pg_attribute as well.  Anyone want to propose a
> specific view definition?
> 

How does this work?

create view pg_userstat as (select  s.starelid ,s.staattnum ,s.staop ,s.stanullfrac ,s.stacommonfrac ,s.stacommonval
,s.staloval,s.stahival ,c.relname ,a.attname ,sh.usenamefrom   pg_statistic as s ,pg_class as c ,pg_shadow as sh
,pg_attributeas awhere (sh.usename=current_user or current_user='postgres') and sh.usesysid = c.relowner and a.attrelid
=c.oid and c.oid = s.starelid
 
);


-- Joe



pgsql-hackers by date:

Previous
From: Tom Lane
Date:
Subject: Re: Isn't pg_statistic a security hole?
Next
From: mlw
Date:
Subject: Re: File system performance and pg_xlog (More info)