Tom Lane 7020c762c6 Disallow RESET ROLE and RESET SESSION AUTHORIZATION inside security-definer ... functions. This extends the previous patch that forbade SETting these variables inside security-definer functions. RESET is equally a security hole, since it would allow regaining privileges of the caller; furthermore it can trigger Assert failures and perhaps other internal errors, since the code is not expecting these variables to change in such contexts. The previous patch did not cover this case because assign hooks don't really have enough information, so move the responsibility for preventing this into guc.c. Problem discovered by Heikki Linnakangas. Security: no CVE assigned yet, extends CVE-2007-6600		2009-09-03 22:08:54 +00:00
..
access	Defend against JOINs having more than 32K columns altogether. We cannot	2008-04-05 01:58:51 +00:00
bootstrap	Tag appropriate files for rc3	2004-12-31 22:04:05 +00:00
catalog	Mark to_number() and the numeric-type variants of to_char() as stable, not	2006-11-28 19:19:07 +00:00
commands	Back-patch the 8.3 fix that prohibits TRUNCATE, CLUSTER, and REINDEX when the	2008-05-27 21:13:50 +00:00
executor	Repair problems occurring when multiple RI updates have to be done to the same	2007-08-15 19:16:12 +00:00
lib	Tag appropriate files for rc3	2004-12-31 22:04:05 +00:00
libpq	When we are in error recursion trouble, arrange to suppress translation and	2009-03-02 21:19:14 +00:00
mb	Replace argument-checking Asserts with regular test-and-elog checks in all	2009-01-29 19:25:01 +00:00
nodes	Fix dynahash.c to suppress hash bucket splits while a hash_seq_search() scan	2007-04-26 23:25:30 +00:00
optimizer	Keep the planner from failing on "WHERE false AND something IN (SELECT ...)".	2007-10-04 20:45:09 +00:00
parser	Add a new GUC parameter backslash_quote, which determines whether the SQL	2006-05-21 20:11:25 +00:00
port	Fix failure to restart Postgres when Linux kernel returns EIDRM for shmctl().	2007-07-02 20:12:11 +00:00
postmaster	Implement a chunking protocol for writes to the syslogger pipe, with messages	2007-06-14 01:50:35 +00:00
regex	Fix assorted security-grade bugs in the regex engine. All of these problems	2008-01-03 20:49:07 +00:00
rewrite	Tag appropriate files for rc3	2004-12-31 22:04:05 +00:00
storage	Widen the nLocks counts in local lock tables from int to int64. This	2008-09-16 01:56:56 +00:00
tcop	Push enable/disable of notify and catchup interrupts all the way down	2005-06-02 21:03:46 +00:00
utils	Disallow RESET ROLE and RESET SESSION AUTHORIZATION inside security-definer	2009-09-03 22:08:54 +00:00
c.h	Change the backend to reject strings containing invalidly-encoded multibyte	2006-05-21 20:06:18 +00:00
fmgr.h	Tag appropriate files for rc3	2004-12-31 22:04:05 +00:00
funcapi.h	Update copyrights that were missed.	2005-01-01 05:43:09 +00:00
getaddrinfo.h	Some more missed copyright notices. Many of these look like they	2005-01-01 20:44:34 +00:00
getopt_long.h	Some more missed copyright notices. Many of these look like they	2005-01-01 20:44:34 +00:00
Makefile	Don't list port twice in SUBDIRS. Caught by Honda Shigehiro.	2005-01-06 21:00:24 +00:00
miscadmin.h	Make standard maintenance operations (including VACUUM, ANALYZE, REINDEX,	2008-01-03 21:25:00 +00:00
pg_config.h.in	Add code to find_my_exec() to resolve a symbolic link down to the	2004-11-06 23:06:29 +00:00
pg_config.h.win32	tag 8.0.21	2009-03-13 02:30:37 +00:00
pg_config_manual.h	Minor cleanup.	2004-09-10 14:27:37 +00:00
pgstat.h	Update copyrights that were missed.	2005-01-01 05:43:09 +00:00
pgtime.h	Tag appropriate files for rc3	2004-12-31 22:04:05 +00:00
port.h	Check for "msys" so it doesn't use 'con' by checking for an evironment	2006-03-05 05:33:47 +00:00
postgres.h	Adjust DatumGetBool macro so that it isn't fooled by garbage in the Datum	2008-03-25 19:31:46 +00:00
postgres_ext.h	Pgindent run for 8.0.	2004-08-29 05:07:03 +00:00
postgres_fe.h	Tag appropriate files for rc3	2004-12-31 22:04:05 +00:00
rusagestub.h	Tag appropriate files for rc3	2004-12-31 22:04:05 +00:00
strdup.h	Fix an obsolete file path mentioned in a comment.	2004-01-25 22:19:42 +00:00