upstream/postgresql
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-04-09 19:16:17 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
Base de données relationnelle
14340 commits 38 branches 679 tags 836 MiB
C 84.5%
PLpgSQL 6.1%
Perl 4.9%
Yacc 1.2%
Meson 0.7%
Other 2.4%
Find a file
Barry Lind 8ba1fa7db1 Backport to 7.3. Third try to fix the sql injection 
vulnerability.  This fix completely removes the ability (hack) of being able
to bind a list of values in an in clause.  It was demonstrated that by allowing
that functionality you open up the possibility for certain types of
sql injection attacks.  The previous fix attempts all focused on preventing
the insertion of additional sql statements (the semi-colon problem:
xxx; any new sql statement here).  But that still left the ability to
change the where clause on the current statement or perform a subselect
which can circumvent applicaiton security logic and/or allow you to call
any stored function.

 Modified Files:
  Tag: REL7_3_STABLE
	jdbc/org/postgresql/Driver.java.in
 	jdbc/org/postgresql/jdbc1/AbstractJdbc1Statement.java
2003-08-07 17:56:27 +00:00
config Be more precise about check for flex 2.5.3, backpatched to 7.3.X. 2003-05-07 04:49:02 +00:00
contrib Allow sub[path|ltre] return void result 2003-07-22 14:08:58 +00:00
doc Add Hungarian/Turkish FAQ's to 7.3.4. 2003-07-24 00:53:57 +00:00
src Backport to 7.3. Third try to fix the sql injection 2003-08-07 17:56:27 +00:00
aclocal.m4 Remove leftovers from subproject removals. Fixes for Python and Kerberos 2002-09-04 22:54:18 +00:00
configure Stamp 7.3.4 release. 2003-07-23 04:10:16 +00:00
configure.in Stamp 7.3.4 release. 2003-07-23 04:10:16 +00:00
COPYRIGHT Update copyright to 2002. 2002-06-20 20:29:54 +00:00
GNUmakefile.in First step to removing /contrib/retep, with Peter Mount's approval. 2002-10-21 00:12:46 +00:00
HISTORY Add to 7.3.4 release notes: 2003-07-24 00:44:24 +00:00
INSTALL Stamp 7.3.4 release. 2003-07-23 04:10:16 +00:00
Makefile Restructure the key include files per recent pghackers discussion: there 2001-02-10 02:31:31 +00:00
README Improve wording. 2002-11-11 19:59:05 +00:00
register.txt Stamp for 7.3 beta3. 2002-10-24 03:03:37 +00:00

README 

PostgreSQL Database Management System
=====================================
  
This directory contains the source code distribution of the PostgreSQL
database management system.

PostgreSQL is an advanced object-relational database management system
that supports an extended subset of the SQL standard, including
transactions, foreign keys, subqueries, triggers, user-defined types
and functions.  This distribution also contains several language
bindings, including C, Perl, Python, and Tcl, as well as a JDBC
driver.

The ODBC and C++ interfaces have been moved to the PostgreSQL Projects
Web Site at http://gborg.postgresql.org for separate maintenance.

See the file INSTALL for instructions on how to build and install
PostgreSQL.  That file also lists supported operating systems and
hardware platforms and contains information regarding any other
software packages that are required to build or run the PostgreSQL
system.  Changes between all PostgreSQL releases are recorded in the
file HISTORY.  Copyright and license information can be found in the
file COPYRIGHT.  A comprehensive documentation set is included in this
distribution; it can be read as described in the installation
instructions.

The latest version of this software may be obtained at
ftp://ftp.postgresql.org/pub/.  For more information look at our web
site located at http://www.postgresql.org/.