mirror of
https://github.com/postgres/postgres.git
synced 2025-06-16 06:01:02 +03:00
Prevent privilege escalation in explicit calls to PL validators.
The primary role of PL validators is to be called implicitly during CREATE FUNCTION, but they are also normal functions that a user can call explicitly. Add a permissions check to each validator to ensure that a user cannot use explicit validator calls to achieve things he could not otherwise achieve. Back-patch to 8.4 (all supported versions). Non-core procedural language extensions ought to make the same two-line change to their own validators. Andres Freund, reviewed by Tom Lane and Noah Misch. Security: CVE-2014-0061
This commit is contained in:
@ -1017,7 +1017,6 @@ CreateFunction(CreateFunctionStmt *stmt, const char *queryString)
|
||||
prorows);
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
* Guts of function deletion.
|
||||
*
|
||||
|
Reference in New Issue
Block a user