pgsql: Make REPLICATION privilege checks test current user not authenti - Mailing list pgsql-committers

Make REPLICATION privilege checks test current user not authenticated user.

The pg_start_backup() and pg_stop_backup() functions checked the privileges
of the initially-authenticated user rather than the current user, which is
wrong.  For example, a user-defined index function could successfully call
these functions when executed by ANALYZE within autovacuum.  This could
allow an attacker with valid but low-privilege database access to interfere
with creation of routine backups.  Reported and fixed by Noah Misch.

Security: CVE-2013-1901

Branch
------
REL9_1_STABLE

Details
-------
http://git.postgresql.org/pg/commitdiff/b403f4107ba74bcf29499ba3e77e0eae70e62679

Modified Files
--------------
src/backend/access/transam/xlog.c |    4 ++--
src/backend/utils/init/miscinit.c |    6 +++---
src/backend/utils/init/postinit.c |    2 +-
src/include/miscadmin.h           |    2 +-
4 files changed, 7 insertions(+), 7 deletions(-)