Re: [HACKERS] Re: [PATCHES] Fw: Isn't pg_statistic a security hole - Solution Proposal

2001-06-13 Thread Tom Lane
"Joe Conway" <[EMAIL PROTECTED]> writes: >> Too late ;-). I just finished ripping out the unneeded parts and >> applying. > Thanks! I take it I still need to do the documentation though ;) I put in a few words in func.sgml, but feel free to improve on it. regards, tom l

Re: [HACKERS] Re: [PATCHES] Fw: Isn't pg_statistic a security hole - Solution Proposal

2001-06-13 Thread Tom Lane
"Joe Conway" <[EMAIL PROTECTED]> writes: > I'll rework the patch per the above and resend. Too late ;-). I just finished ripping out the unneeded parts and applying. I made a few minor changes too, mostly removing unnecessary code (you don't need to call nameout, everyone else just uses NameStr

Re: [HACKERS] Re: [PATCHES] Fw: Isn't pg_statistic a security hole - Solution Proposal

2001-06-13 Thread Tom Lane
Peter Eisentraut <[EMAIL PROTECTED]> writes: >> Could we make the assumption that table names in catalogs >> will be of type 'name'? > I wouldn't want to guarantee it for the information schema. Your objections are not without merit, and in the interest of bringing this thing to closure I'll con

Re: [HACKERS] Re: [PATCHES] Fw: Isn't pg_statistic a security hole - Solution Proposal

2001-06-08 Thread Tom Lane
"Joe Conway" <[EMAIL PROTECTED]> writes: > Is the concern that the name-based variants of the function should be called > like: >select has_table_privilege(current_user, pg_class, 'insert'); > or >select has_table_privilege(current_user, "My Quoted Relname", 'insert'); It'd be reall

Re: [HACKERS] Re: [PATCHES] Fw: Isn't pg_statistic a security hole - Solution Proposal

2001-06-07 Thread Tom Lane
Peter Eisentraut <[EMAIL PROTECTED]> writes: > Since these functions will primarily be used in building a sort of > information schema and for querying system catalogs, we should use the > approach that is or will be used there: character type values contain the > table name already case-adjusted

AW: [HACKERS] Re: [PATCHES] Fw: Isn't pg_statistic a security hole - Solution Proposal

2001-06-07 Thread Zeugswetter Andreas SB
> What if I rename the get_seq_name function and move it to > backend/utils/adt/name.c (and of course change the references to it in > sequence.c)? Actually, now I'm wondering why nameout doesn't > downcase and > truncate. Because identifiers can be double quoted if you feel like preserving case

Re: [HACKERS] Re: [PATCHES] Fw: Isn't pg_statistic a security hole - Solution Proposal

2001-06-06 Thread Tom Lane
"Joe Conway" <[EMAIL PROTECTED]> writes: > I wasn't quite sure if there are changes I can/should make to > has_table_privilege based on this discussion. My feeling is that the name-based variants of has_table_privilege should perform downcasing and truncation of the supplied strings before trying

[HACKERS] Re: [PATCHES] Fw: Isn't pg_statistic a security hole - Solution Proposal

2001-06-03 Thread Tom Lane
Peter Eisentraut <[EMAIL PROTECTED]> writes: > IMHO, nextval() isn't the greatest interface in the world. I do like the > alternative (deprecated?) syntax sequence.nextval() because of the > notational resemblence to OO. Try "nonexistent". I too would like a notation like that, because it would