Make REPLICATION privilege checks test current user not authenticated user.
The pg_start_backup() and pg_stop_backup() functions checked the privileges
of the initially-authenticated user rather than the current user, which is
wrong. For example, a user-defined index function could successfully call
these functions when executed by ANALYZE within autovacuum. This could
allow an attacker with valid but low-privilege database access to interfere
with creation of routine backups. Reported and fixed by Noah Misch.
Security: CVE-2013-1901
Branch
------
master
Details
-------
http://git.postgresql.org/pg/commitdiff/ce9ab88981495d975aade8fc664f99f68fc18e2b
Modified Files
--------------
src/backend/access/transam/xlog.c | 4 ++--
src/backend/utils/init/miscinit.c | 6 +++---
src/backend/utils/init/postinit.c | 2 +-
src/include/miscadmin.h | 2 +-
4 files changed, 7 insertions(+), 7 deletions(-)
