database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-27 12:41:57 +03:00
Code Activity

Re-validate connection string in libpqrcv_connect().

Browse Source 
A superuser may create a subscription with password_required=true, but
which uses a connection string without a password.

Previously, if the owner of such a subscription was changed to a
non-superuser, the non-superuser was able to utilize a password from
another source (like a password file or the PGPASSWORD environment
variable), which should not have been allowed.

This commit adds a step to re-validate the connection string before
connecting.

Reported-by: Jeff Davis
Author: Vignesh C
Reviewed-by: Peter Smith, Robert Haas, Amit Kapila
Discussion: https://www.postgresql.org/message-id/flat/e5892973ae2a80a1a3e0266806640dae3c428100.camel%40j-davis.com
Backpatch-through: 16
This commit is contained in:
Jeff Davis
2024-01-12 13:42:09 -08:00
parent 9c00e4c775
commit 4c03ac7e2b
3 changed files with 95 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
doc/src/sgml/ref/create_subscription.sgml
View File

@ -357,11 +357,12 @@ CREATE SUBSCRIPTION <replaceable class="parameter">subscription_name</replaceabl
<term><literal>password_required</literal> (<type>boolean</type>)</term>
<listitem>
<para>
Specifies whether connections to the publisher made as a result
of this subscription must use password authentication. This setting
is ignored when the subscription is owned by a superuser.
The default is <literal>true</literal>. Only superusers can set
this value to <literal>false</literal>.
If set to <literal>true</literal>, connections to the publisher made
as a result of this subscription must use password authentication
and the password must be specified as a part of the connection
string. This setting is ignored when the subscription is owned by a
superuser. The default is <literal>true</literal>. Only superusers
can set this value to <literal>false</literal>.
</para>
</listitem>
</varlistentry>