Home > mailing lists

Re: BUG #13651: trigger security invoker attack - Mailing list pgsql-bugs

From	德哥
Subject	Re: BUG #13651: trigger security invoker attack
Date	September 30, 2015 20:27:46
Msg-id	1ad9dff4.9584.1501d0f6c58.Coremail.digoal@126.com Whole thread Raw
In response to	Re: BUG #13651: trigger security invoker attack ("David G. Johnston" <david.g.johnston@gmail.com>)
List	pgsql-bugs

HI,

If we can change the function's security dynamical, like :

When function trigged in trigger or rule, force these function's security = table,mview,view's owner.

There will no risks in the case.

PS: MySQL do that.

From: 德哥
Date: 30 September 2015, 20:27:36
Subject: Re: BUG #13651: trigger security invoker attack

From: marc hamelin
Date: 30 September 2015, 20:27:59
Subject: postgresql 9.4 with nested "order by"