Noah, * Noah Misch (n...@leadboat.com) wrote: > On Mon, Jan 12, 2015 at 05:16:40PM -0500, Stephen Frost wrote: > > Alright, here's an updated patch which doesn't return any detail if no > > values are visible or if only a partial key is visible. > > I browsed this patch. There's been no mention of foreign key constraints, but > ri_ReportViolation() deserves similar hardening. If a user has only DELETE > privilege on a PK table, FK violation messages should not leak the PK values. > Modifications to the foreign side are less concerning, since the user will > often know the attempted value; still, I would lock down both sides.
Ah, yes, good point.
> Please add a comment explaining the safety of each row-emitting message you
> haven't changed. For example, the one in refresh_by_match_merge() is safe
> because getting there requires MV ownership.
Sure.
> Instead of duplicating an entire ereport() to change whether you include an
> errdetail, use "condition ? errdetail(...) : 0".
Yeah, that's a bit nicer, will do.
Thanks!
Stephen
signature.asc
Description: Digital signature
