Re: [HACKERS] CREATE CONSTRAINT TRIGGER appears to be a security hole

2002-08-14 Thread Tom Lane
Peter Eisentraut <[EMAIL PROTECTED]> writes: > While the REFERENCES privilege controls who can create foreign keys > referring to one's tables, it seems you can evade it by using CREATE > CONSTRAINT TRIGGER directly. Good point. > It seems we need to check the privilege on the table mentioned in

[HACKERS] CREATE CONSTRAINT TRIGGER appears to be a security hole

2002-08-14 Thread Peter Eisentraut
While the REFERENCES privilege controls who can create foreign keys referring to one's tables, it seems you can evade it by using CREATE CONSTRAINT TRIGGER directly. This is the "slave" portion of a FK constraint I got from pg_dump: CREATE CONSTRAINT TRIGGER "$1" AFTER INSERT OR UPDATE ON "s