Make REPLICATION privilege checks test current user not authenticated user.
The pg_start_backup() and pg_stop_backup() functions checked the privileges
of the initially-authenticated user rather than the current user, which is
wrong. For example, a user-defined index function could successfully call
these functions when executed by ANALYZE within autovacuum. This could
allow an attacker with valid but low-privilege database access to interfere
with creation of routine backups. Reported and fixed by Noah Misch.
Security: CVE-2013-1901
Branch
------
REL9_2_STABLE
Details
-------
http://git.postgresql.org/pg/commitdiff/e5fdb8feadd4385671bab0e2c4c57008f3ba8dda
Modified Files
--------------
src/backend/access/transam/xlog.c | 4 ++--
src/backend/utils/init/miscinit.c | 6 +++---
src/backend/utils/init/postinit.c | 2 +-
src/include/miscadmin.h | 2 +-
4 files changed, 7 insertions(+), 7 deletions(-)
