Re: chkpass Major Issue - compares 'contains' and not 'equal' - Mailing list pgsql-bugs

From David G. Johnston
Subject Re: chkpass Major Issue - compares 'contains' and not 'equal'
Date
Msg-id CAKFQuwbkHkCjbg+BtLg-7P+D1Ma=Yn6N=POc+jCjLGdTU3iozg@mail.gmail.com
Whole thread Raw
In response to chkpass Major Issue - compares 'contains' and not 'equal'  (Eyedia Tech <eyedia@debjyoti.com>)
Responses Re: chkpass Major Issue - compares 'contains' and not 'equal'  (D'Arcy Cain <darcy@druid.net>)
List pgsql-bugs
On Thursday, June 7, 2018, Eyedia Tech <eyedia@debjyoti.com> wrote:
To replicate use this:

create table "user" (uname text, password chkpass);
insert into "user" values ('user1', 'password')
select * from "user" where uname = 'user1' and password = 'password1'

This is a major issue.

It is also a documented limitation.

The encryption uses the standard Unix function crypt(), and so it suffers from all the usual limitations of that function; notably that only the first eight characters of a password are considered.


At this point I'd consider its presence here for backward compatibility only and as such the behavior is not something that is likely to be changed.

David J.

pgsql-bugs by date:

Previous
From: Dmitry Dolgov
Date:
Subject: Re: BUG #15212: Default values in partition tables don't work asexpected and allow NOT NULL violation
Next
From: Tom Lane
Date:
Subject: Re: chkpass Major Issue - compares 'contains' and not 'equal'