Thread: REVOKE on ALTER USER, DROP USER
Hello,
Is het possible tot REVOKE the ALTER USER command? In such a way that users cannot change their password and username?
And also cannot delete themeself with DROP USER?
Now I solve the problem in PHP, to filter de SQL query string behore sending to postgresql as follows:
1. selete double, triple etc, spaces (with regular expression: ~ {2,}~)
2. upper the string (with strtoupper())
3. delete SQL commondos (with '#(ALTER USER|DROP USER)#siU'
but you can still create a pgsql function that's excute SQL commando's and maybe other ways... So this isn't a good option.
I can't make new database users. That is forbidden by my host. So i don't want to lose any users. Has someone ideas??
Greetz,
Tjibbe
De nieuwe Hotmail: Nu 2 GB aan opslag - dat zijn maar liefst 1000 foto's - en nog steeds gratis! Windows Live Hotmail
Tjibbe <tjibbe@hotmail.com> writes:
> Hello, Is het possible tot REVOKE the ALTER USER command? In such a way tha=
> t users cannot change their password and username? And also cannot delete t=
> hemeself with DROP USER?
Ordinary users (those without superuser or createrole privilege) can't
do any of that except change their own password ... and I don't see a
particularly good argument for preventing them from doing that.
> Now I solve the problem in PHP, to filter de SQL query string behore sendin=
> g to postgresql as follows:
If you're allowing untrusted sources to provide chunks of SQL to be
executed directly, you've got problems far worse than this one.
regards, tom lane
But is it possible?
For a demo account it can be handy. Because visitors, can change the vistor account, so the next visitor can't login. And the owner of the demo can't recover the password.
The problem for me is that I only have 2 database users. So i can't afford is to lose one.
Tjibbe
> To: t.b.rijpma@student.tudelft.nl
> CC: pgsql-novice@postgresql.org
> Subject: Re: [NOVICE] REVOKE on ALTER USER, DROP USER
> Date: Sun, 8 Jul 2007 12:22:58 -0400
> From: tgl@sss.pgh.pa.us
>
> Tjibbe <tjibbe@hotmail.com> writes:
> > Hello, Is het possible tot REVOKE the ALTER USER command? In such a way tha=
> > t users cannot change their password and username? And also cannot delete t=
> > hemeself with DROP USER?
>
> Ordinary users (those without superuser or createrole privilege) can't
> do any of that except change their own password ... and I don't see a
> particularly good argument for preventing them from doing that.
>
> > Now I solve the problem in PHP, to filter de SQL query string behore sendin=
> > g to postgresql as follows:
>
> If you're allowing untrusted sources to provide chunks of SQL to be
> executed directly, you've got problems far worse than this one.
>
> regards, tom lane
>
> ---------------------------(end of broadcast)---------------------------
> TIP 4: Have you searched our list archives?
>
> http://archives.postgresql.org
De nieuwe Hotmail: Nu 2 GB aan opslag - dat zijn maar liefst 1000 foto's - en nog steeds gratis! Windows Live Hotmail
For a demo account it can be handy. Because visitors, can change the vistor account, so the next visitor can't login. And the owner of the demo can't recover the password.
The problem for me is that I only have 2 database users. So i can't afford is to lose one.
Tjibbe
> To: t.b.rijpma@student.tudelft.nl
> CC: pgsql-novice@postgresql.org
> Subject: Re: [NOVICE] REVOKE on ALTER USER, DROP USER
> Date: Sun, 8 Jul 2007 12:22:58 -0400
> From: tgl@sss.pgh.pa.us
>
> Tjibbe <tjibbe@hotmail.com> writes:
> > Hello, Is het possible tot REVOKE the ALTER USER command? In such a way tha=
> > t users cannot change their password and username? And also cannot delete t=
> > hemeself with DROP USER?
>
> Ordinary users (those without superuser or createrole privilege) can't
> do any of that except change their own password ... and I don't see a
> particularly good argument for preventing them from doing that.
>
> > Now I solve the problem in PHP, to filter de SQL query string behore sendin=
> > g to postgresql as follows:
>
> If you're allowing untrusted sources to provide chunks of SQL to be
> executed directly, you've got problems far worse than this one.
>
> regards, tom lane
>
> ---------------------------(end of broadcast)---------------------------
> TIP 4: Have you searched our list archives?
>
> http://archives.postgresql.org
Jouw nieuws: wereldnieuws! Beleef 't op MSN.nl
De nieuwe Hotmail: Nu 2 GB aan opslag - dat zijn maar liefst 1000 foto's - en nog steeds gratis! Windows Live Hotmail
But it is some strange that somebody can change the password without knowing the old one... So if you leave your computer alone everone can change the password. So he can login.
But is it possible?
From: tjibbe@hotmail.com
To: pgsql-novice@postgresql.org
Subject: Re: [NOVICE] REVOKE on ALTER USER, DROP USER
Date: Sun, 8 Jul 2007 21:36:34 +0200
For a demo account it can be handy. Because visitors, can change the vistor account, so the next visitor can't login. And the owner of the demo can't recover the password.
The problem for me is that I only have 2 database users. So i can't afford is to lose one.
Tjibbe
> To: t.b.rijpma@student.tudelft.nl
> CC: pgsql-novice@postgresql.org
> Subject: Re: [NOVICE] REVOKE on ALTER USER, DROP USER
> Date: Sun, 8 Jul 2007 12:22:58 -0400
> From: tgl@sss.pgh.pa.us
>
> Tjibbe <tjibbe@hotmail.com> writes:
> > Hello, Is het possible tot REVOKE the ALTER USER command? In such a way tha=
> > t users cannot change their password and username? And also cannot delete t=
> > hemeself with DROP USER?
>
> Ordinary users (those without superuser or createrole privilege) can't
> do any of that except change their own password ... and I don't see a
> particularly good argument for preventing them from doing that.
>
> > Now I solve the problem in PHP, to filter de SQL query string behore sendin=
> > g to postgresql as follows:
>
> If you're allowing untrusted sources to provide chunks of SQL to be
> executed directly, you've got problems far worse than this one.
>
> regards, tom lane
>
> ---------------------------(end of broadcast)---------------------------
> TIP 4: Have you searched our list archives?
>
> http://archives.postgresql.org
Jouw nieuws: wereldnieuws! Beleef 't op MSN.nl
De nieuwe Hotmail: Nu 2 GB aan opslag - dat zijn maar liefst 1000 foto's - en nog steeds gratis! Windows Live Hotmail
Windows Live Messenger het beste van de toekomst Download NU! Windows Live Messenger!