Re: [patch] fix dblink security hole - Mailing list pgsql-hackers

From Joe Conway
Subject Re: [patch] fix dblink security hole
Date
Msg-id 48D7A332.1040705@joeconway.com
Whole thread Raw
In response to Re: [patch] fix dblink security hole  (Tom Lane <tgl@sss.pgh.pa.us>)
Responses Re: [patch] fix dblink security hole  (Tom Lane <tgl@sss.pgh.pa.us>)
List pgsql-hackers
Tom Lane wrote:
> Joe Conway <mail@joeconway.com> writes:
>> Tom Lane wrote:
>>> What do you think about getting rid of the password_from_string state
>>> variable?  It was always a bit of a kluge, and we don't seem to need
>>> it anymore with this approach.
> 
>> It is still used in PQconnectionUsedPassword(). That is still needed to 
>> prevent a non-superuser from logging in as the superuser if the server 
>> does not require authentication.
> 
> No, the test to see if the server actually *asked* for the password is
> the important part at that end.

Oh, I see that now. So yes, as far as I can tell, password_from_string 
is not used for anything anymore and should be removed.

Joe


pgsql-hackers by date:

Previous
From: Tom Lane
Date:
Subject: Re: pg_dump feature
Next
From: Tom Lane
Date:
Subject: Re: WIP patch: Collation support