Tom Lane ce9ab88981 Make REPLICATION privilege checks test current user not authenticated user. ...

The pg_start_backup() and pg_stop_backup() functions checked the privileges
of the initially-authenticated user rather than the current user, which is
wrong.  For example, a user-defined index function could successfully call
these functions when executed by ANALYZE within autovacuum.  This could
allow an attacker with valid but low-privilege database access to interfere
with creation of routine backups.  Reported and fixed by Noah Misch.

Security: CVE-2013-1901

2013-04-01 13:09:24 -04:00

..

access

Make REPLICATION privilege checks test current user not authenticated user.

2013-04-01 13:09:24 -04:00

bootstrap

Allow I/O reliability checks using 16-bit checksums

2013-03-22 13:54:07 +00:00

catalog

Add new JSON processing functions and parser API.

2013-03-29 14:12:13 -04:00

commands

Add sql_drop event for event triggers

2013-03-28 13:05:48 -03:00

executor

Support writable foreign tables.

2013-03-10 14:16:02 -04:00

foreign

Arrange to cache FdwRoutine structs in foreign tables' relcache entries.

2013-03-06 23:48:09 -05:00

lib

Update copyrights for 2013

2013-01-01 17:15:01 -05:00

libpq

Move pqsignal() to libpgport.

2013-03-17 12:06:42 -04:00

main

Move pqsignal() to libpgport.

2013-03-17 12:06:42 -04:00

nodes

Support writable foreign tables.

2013-03-10 14:16:02 -04:00

optimizer

Ignore extra subquery outputs in set_subquery_size_estimates().

2013-03-31 18:34:15 -04:00

parser

Add sql_drop event for event triggers

2013-03-28 13:05:48 -03:00

po

Translation updates

2011-08-17 14:07:46 +03:00

port

Move pqsignal() to libpgport.

2013-03-17 12:06:42 -04:00

postmaster

Reset OpenSSL randomness state in each postmaster child process.

2013-03-27 18:50:21 -04:00

regex

Fix infinite-loop risk in fixempties() stage of regex compilation.

2013-03-07 11:51:03 -05:00

replication

In base backup, only include our own tablespace version directory.

2013-03-25 20:19:22 +02:00

rewrite

Extend object-access hook machinery to support post-alter events.

2013-03-17 22:57:26 -04:00

snowball

Update copyrights for 2013

2013-01-01 17:15:01 -05:00

storage

Improve code documentation about "magnetic disk" storage manager.

2013-03-30 14:23:45 -04:00

tcop

Avoid "variable might be clobbered by longjmp" warning.

2013-03-28 13:19:49 -04:00

tsearch

Update copyrights for 2013

2013-01-01 17:15:01 -05:00

utils

Make REPLICATION privilege checks test current user not authenticated user.

2013-04-01 13:09:24 -04:00

.gitignore

Add gitignore for mingw/cygwin build outputs

2011-06-09 18:11:47 +02:00

common.mk

Call check_keywords.pl in maintainer-check

2012-02-27 13:53:12 +02:00

Makefile

Move relpath() to libpgcommon

2013-02-21 22:46:17 -03:00

nls.mk

Split out XLog reading as an independent facility

2013-01-16 16:12:53 -03:00