Tom Lane ce9ab88981 Make REPLICATION privilege checks test current user not authenticated user. ...

The pg_start_backup() and pg_stop_backup() functions checked the privileges
of the initially-authenticated user rather than the current user, which is
wrong.  For example, a user-defined index function could successfully call
these functions when executed by ANALYZE within autovacuum.  This could
allow an attacker with valid but low-privilege database access to interfere
with creation of routine backups.  Reported and fixed by Noah Misch.

Security: CVE-2013-1901

2013-04-01 13:09:24 -04:00

..

globals.c

Revoke bc5334d8679c428a709d150666b288171795bd76

2013-03-28 09:18:02 +00:00

Makefile

Remove cvs keywords from all files.

2010-09-20 22:08:53 +02:00

miscinit.c

Make REPLICATION privilege checks test current user not authenticated user.

2013-04-01 13:09:24 -04:00

postinit.c

Make REPLICATION privilege checks test current user not authenticated user.

2013-04-01 13:09:24 -04:00