Re: Nasty security bug with clustering - Mailing list pgsql-hackers

From Tom Lane
Subject Re: Nasty security bug with clustering
Date
Msg-id 27886.1083157741@sss.pgh.pa.us
Whole thread Raw
In response to Re: Nasty security bug with clustering  (Christopher Kings-Lynne <chriskl@familyhealth.com.au>)
Responses Re: Nasty security bug with clustering  (Christopher Kings-Lynne <chriskl@familyhealth.com.au>)
Re: Nasty security bug with clustering  ("Christopher Kings-Lynne" <chriskl@familyhealth.com.au>)
List pgsql-hackers
Christopher Kings-Lynne <chriskl@familyhealth.com.au> writes:
>> No check is performed for being a superuser, the table owner or that it 
>> is a system table when marking an index for clustering:

> I'm about to submit my SET WITHOUT CLUSTER patch, so I'll fix this bug 
> in that.

I'm in the middle of reviewing (read whacking around) Rod Taylor's patch
for multiple operations in ALTER TABLE, so I'm afraid that no patch in
the same area is likely to apply cleanly after the dust settles :-(

I had noted the lack of permissions checks in CLUSTER ON (it's fairly
glaring in the reorganized code) and planned to fix it along with what
I was doing.
        regards, tom lane


pgsql-hackers by date:

Previous
From: Jon Jensen
Date:
Subject: Re: Usability, MySQL, Postgresql.org, gborg, contrib,
Next
From: Fabien COELHO
Date:
Subject: pg ANY/SOME ambiguity wrt sql standard?