Re: document the dangers of granting TRIGGER or REFERENCES - Mailing list pgsql-hackers

From Tom Lane
Subject Re: document the dangers of granting TRIGGER or REFERENCES
Date
Msg-id 3337978.1784044609@sss.pgh.pa.us
Whole thread
In response to Re: document the dangers of granting TRIGGER or REFERENCES  (Robert Haas <robertmhaas@gmail.com>)
List pgsql-hackers
Robert Haas <robertmhaas@gmail.com> writes:
> Also, while there may very well be people who have legitimately been
> unpleasantly surprised by the actual behavior here, an awful lot of
> the "people" currently discovering the situation here are in fact just
> looking for a way to manufacture a security report. As long as we have
> a statement of some kind in the docs, we can just point to that. It
> doesn't need to be particularly prominent -- although I'm not trying
> to conceal it, either. I didn't find a more natural place to mention
> this than where I actually put it.

Right.  I looked around too, but this section (5.9) seems fine.
In particular, while the GRANT reference page lists the names of
the privileges, it does not describe any of them, just points you
to 5.9.

            regards, tom lane



pgsql-hackers by date:

Previous
From: Tom Lane
Date:
Subject: Re: document the dangers of granting TRIGGER or REFERENCES
Next
From: Sami Imseih
Date:
Subject: Re: [Proposal] Adding callback support for custom statistics kinds