From: antonov@stdpr.ru
To: pgsql-docs@postgresql.org
Subject: "$user" and SESSION_USER and CURRENT_USER
Date: Thu, 20 Dec 2018 18:38:26 +0300
Message-ID: <159151fb45d490c8d31ea9707e9ba99d@stdpr.ru> (raw)
hi,
sorry for my message. I'm tiny confused about the next one. could you
help me?:
here -- https://www.postgresql.org/docs/11/runtime-config-client.html
there is the text """If one of the list items is the special name $user,
then the schema having the name returned by SESSION_USER is substituted,
if there is such a schema and the user has USAGE permission for it. (If
not, $user is ignored.)""".
but actualy "$user" substitutes CURRENT_USER-value (not
SESSION_USER-value).
it's good because it would be a SECURITY VULNERABILITY if "$user"
substituted SESSION_USER-value (in conjunction with security definer
functions).
in case of CURRENT_USER-value we have no the vulnerable. which is good
:-)
but is there error in documentation text (runtime-config-client.html) ,
isn't?
thank you in advance.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: antonov@stdpr.ru
Subject: Re: "$user" and SESSION_USER and CURRENT_USER
In-Reply-To: <159151fb45d490c8d31ea9707e9ba99d@stdpr.ru>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox