On Mon, Jul 23, 2007 at 10:59:17AM -0300, Thiago Maluf wrote:
> I have one database server with postgresql 8.1 and I discovered yesterday
> one security problem.
> When I access my server with thought psql I have the possibility execute
> command in my server using "\!" or write one file using "\e".
> I want disable these options in my server but I searched it and not found.
These psql commands run on the client with the privileges of the
client; they don't allow the client to do anything it couldn't
already do from the shell, and presumably the client already has
access to the shell if it's running psql. This would be a security
problem if you use psql to run SQL statements from an untrusted
source, but if you're doing that then you already have a security
problem.
--
Michael Fuhr
