Subject: Security, Ports, and abstime bugs

From: [email-masked]
Date: Wed, 6 May 92 00:27:23 -0700

Postgressians,

First a note of confirmation of the previous security problem posting.
On Sun (SPARC2,IPC) SunOS (4.1.1, 4.1.1B, 4.1.2) *any* user can do the
following:
	/usr/postgres/bin/monitor foo
and proceed to mung the database foo.  I don't know about other platforms,
but it is a serious detriment to doing "real" work with postgres.  Anyone
can maliciously delete all of your data. Is there any chance this will be
fixed in the upcoming release?

Second, I have re-written/ported libpq to MSDOS using the FTP Software
network libraries - is there any interest in the code?  (There are *precisely*
four network related calls in the whole library now - the next step
is to convert those 4 to the appropriate API calls so that we'll have
a Windows 3.x DLL library - any volunteers to help?)

Third, is anything being done to make the abstime functions and input
parse a bit more consistent?  abstime won't even swallow it's own output,
which can cause no end of problems when programming interfaces to postgres.
Incidentally, for a good time try this:
> % monitor
> Welcome to the C POSTGRES terminal monitor
>  
> Go 
> * create junk (date=abstime)\g
>
> Query sent to backend is "create junk (date=abstime)"
> CREATE
> Go 
> * append junk (date = "Jan  1 21:11:11 1992"::abstime)\g
> 
> Query sent to backend is "append junk (date = "Jan  1 21:11:11 1992"::abstime)"
> APPEND
> Go 
> * retrieve (junk.all)\g
>
> Query sent to backend is "retrieve (junk.all)"
> ---------------
> | date        |
> ---------------
> | Jan  1 00:11:11 1992 MDT|
> ---------------

So where did the 21 hours go????  And Jan 1 is in MST not MDT.  Does this only
happen on Suns or is it a more general "feature"?  A less drastic but
related feature happens any time one crosses the daylight/standard time
boundry - an hour is added/subtracted but the time is still reputed to
be in the current daylight/standard format.

Thanks for any enlightenment.

	Dr. Daniel L. Jones
	Chief Scientist - Jones Technologies Inc.
	[email-masked]

---

From: postarch (Postgres Mailing Archive)
Date: Mon, 11 May 92 11:18:46 PDT

you write:

> > Query sent to backend is "append junk (date = "Jan  1 21:11:11 1992"::absti
 +me)"
> be in the current daylight/standard format.

The abstime adt has been rewritten using real date parsing code.  These
problems will go away with version 4.

Jeff Meredith
[email-masked]