From: Bruce Momjian <bruce@momjian.us>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: David G. Johnston <david.g.johnston@gmail.com>
Cc: exclusion@gmail.com, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
Subject: Re: BUG #16486: Prompted password is ignored when password specified in connection string
Date: Tue, 1 Sep 2020 16:38:46 -0400
Message-ID: <20200901203846.GA13613@momjian.us> (raw)
In-Reply-To: <2142411.1591667958@sss.pgh.pa.us>
References: <16486-b9c93d71c02c4907@postgresql.org>
<2090524.1591652199@sss.pgh.pa.us>
<CAKFQuwbk=SDVVhe=P=eAsX4Zip_0tR+vZOOMM-VvHAH0=We=_g@mail.gmail.com>
<2110959.1591655226@sss.pgh.pa.us>
<2142411.1591667958@sss.pgh.pa.us>
On Mon, Jun 8, 2020 at 09:59:18PM -0400, Tom Lane wrote:
> I wrote:
> > Hmm ... I had thought that the docs explained -W in more or less the same
> > way I did above, but I see that (at least on the psql page) things are
> > indeed pretty vague. I'll see about improving that.
>
> Concretely, it looks like we need edits as attached for psql, and
> likewise for all our other programs with similar options.
>
> The thing that was really missing here IMO is the specification that a
> conninfo string overrides other command-line parameters. It's somewhat
> debatable whether a -W prompt is a "command line parameter", but it
> acts that way for this purpose. In any case, I'm disinclined to document
> that specific interaction, because it would amount to blessing a pretty
> damfool practice, which is to make your password visible on the program's
> command line. (I wonder whether section 33.1.2 ought to specifically
> caution against putting passwords into command-line conninfo strings.)
I used a later version of Tom's patch to add documentation of how
connection strings can override command-line options, plus it has the
password description improvements.
I would like to apply this to all supported versions.
--
Bruce Momjian <bruce@momjian.us> https://momjian.us
EnterpriseDB https://enterprisedb.com
The usefulness of a cup is in its emptiness, Bruce Lee
Attachments:passwd.diff (text/x-diff, 10.9K) downloaddiff --git a/doc/src/sgml/ref/clusterdb.sgml b/doc/src/sgml/ref/clusterdb.sgmlindex 177856ca74..3049c915bb 100644--- a/doc/src/sgml/ref/clusterdb.sgml+++ b/doc/src/sgml/ref/clusterdb.sgml@@ -95,7 +95,9 @@ PostgreSQL documentation
<option>--all</option>) is not used, the database name is read
from the environment variable <envar>PGDATABASE</envar>. If
that is not set, the user name specified for the connection is
- used.+ used. <link linkend="libpq-connstring">Connction strings</link>+ can also be used for connection specifications, and these can+ override other command-line options.
</para>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/ref/pg_basebackup.sgml b/doc/src/sgml/ref/pg_basebackup.sgmlindex aa0b27c9f3..19c7d098b9 100644--- a/doc/src/sgml/ref/pg_basebackup.sgml+++ b/doc/src/sgml/ref/pg_basebackup.sgml@@ -653,8 +653,9 @@ PostgreSQL documentation
<term><option>--dbname=<replaceable class="parameter">connstr</replaceable></option></term>
<listitem>
<para>
- Specifies parameters used to connect to the server, as a connection- string. See <xref linkend="libpq-connstring"/> for more information.+ Specifies parameters used to connect to the server, as a <link+ linkend="libpq-connstring">connction strings</link>; these+ can override other command-line options.
</para>
<para>
The option is called <literal>--dbname</literal> for consistency with other
diff --git a/doc/src/sgml/ref/pg_dump.sgml b/doc/src/sgml/ref/pg_dump.sgmlindex 0b2e2de87b..f4b209af83 100644--- a/doc/src/sgml/ref/pg_dump.sgml+++ b/doc/src/sgml/ref/pg_dump.sgml@@ -1130,14 +1130,10 @@ PostgreSQL documentation
Specifies the name of the database to connect to. This is
equivalent to specifying <replaceable
class="parameter">dbname</replaceable> as the first non-option
- argument on the command line.- </para>- <para>- If this parameter contains an <symbol>=</symbol> sign or starts- with a valid <acronym>URI</acronym> prefix- (<literal>postgresql://</literal>- or <literal>postgres://</literal>), it is treated as a- <parameter>conninfo</parameter> string. See <xref linkend="libpq-connect"/> for more information.+ argument on the command line. <link+ linkend="libpq-connstring">Connction strings</link> can also be+ used for connection specifications, and these can override other+ command-line options.
</para>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/ref/pg_dumpall.sgml b/doc/src/sgml/ref/pg_dumpall.sgmlindex 43abc530a0..e7868091b9 100644--- a/doc/src/sgml/ref/pg_dumpall.sgml+++ b/doc/src/sgml/ref/pg_dumpall.sgml@@ -550,8 +550,9 @@ PostgreSQL documentation
<term><option>--dbname=<replaceable class="parameter">connstr</replaceable></option></term>
<listitem>
<para>
- Specifies parameters used to connect to the server, as a connection- string. See <xref linkend="libpq-connstring"/> for more information.+ Specifies parameters used to connect to the server, as a <link+ linkend="libpq-connstring">connction strings</link>; these+ can override other command-line options.
</para>
<para>
The option is called <literal>--dbname</literal> for consistency with other
diff --git a/doc/src/sgml/ref/pg_isready.sgml b/doc/src/sgml/ref/pg_isready.sgmlindex 3d5b551b87..63ef1d785a 100644--- a/doc/src/sgml/ref/pg_isready.sgml+++ b/doc/src/sgml/ref/pg_isready.sgml@@ -47,15 +47,10 @@ PostgreSQL documentation
<term><option>--dbname=<replaceable class="parameter">dbname</replaceable></option></term>
<listitem>
<para>
- Specifies the name of the database to connect to.- </para>- <para>- If this parameter contains an <symbol>=</symbol> sign or starts- with a valid <acronym>URI</acronym> prefix- (<literal>postgresql://</literal>- or <literal>postgres://</literal>), it is treated as a- <parameter>conninfo</parameter> string. See <xref- linkend="libpq-connstring"/> for more information.+ Specifies the name of the database to connect to. <link+ linkend="libpq-connstring">Connction strings</link> can also be+ used for connection specifications, and these can override other+ command-line options.
</para>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/ref/pg_receivewal.sgml b/doc/src/sgml/ref/pg_receivewal.sgmlindex 865ec84262..76d2ba48fa 100644--- a/doc/src/sgml/ref/pg_receivewal.sgml+++ b/doc/src/sgml/ref/pg_receivewal.sgml@@ -252,8 +252,9 @@ PostgreSQL documentation
<term><option>--dbname=<replaceable class="parameter">connstr</replaceable></option></term>
<listitem>
<para>
- Specifies parameters used to connect to the server, as a connection- string. See <xref linkend="libpq-connstring"/> for more information.+ Specifies parameters used to connect to the server, as a <link+ linkend="libpq-connstring">connction strings</link>; these+ can override other command-line options.
</para>
<para>
The option is called <literal>--dbname</literal> for consistency with other
diff --git a/doc/src/sgml/ref/pg_recvlogical.sgml b/doc/src/sgml/ref/pg_recvlogical.sgmlindex 41508fdc1e..a9651b0921 100644--- a/doc/src/sgml/ref/pg_recvlogical.sgml+++ b/doc/src/sgml/ref/pg_recvlogical.sgml@@ -277,10 +277,11 @@ PostgreSQL documentation
<term><option>--dbname=<replaceable>database</replaceable></option></term>
<listitem>
<para>
- The database to connect to. See the description of the actions for- what this means in detail. This can be a <application>libpq</application> connection string;- see <xref linkend="libpq-connstring"/> for more information. Defaults- to user name.+ The database to connect to. See the description+ of the actions for what this means in detail. <link+ linkend="libpq-connstring">Connction strings</link> can also+ be used for connection specifications, and these can override+ other command-line options. Defaults to the user name.
</para>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/ref/pg_restore.sgml b/doc/src/sgml/ref/pg_restore.sgmlindex 27eab2f02a..a4f2ee9f43 100644--- a/doc/src/sgml/ref/pg_restore.sgml+++ b/doc/src/sgml/ref/pg_restore.sgml@@ -156,7 +156,9 @@ PostgreSQL documentation
<para>
Connect to database <replaceable
class="parameter">dbname</replaceable> and restore directly
- into the database.+ into the database. <link linkend="libpq-connstring">Connction+ strings</link> can also be used for connection specifications,+ and these can override other command-line options.
</para>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/ref/psql-ref.sgml b/doc/src/sgml/ref/psql-ref.sgmlindex 201946990f..b9a0ab245a 100644--- a/doc/src/sgml/ref/psql-ref.sgml+++ b/doc/src/sgml/ref/psql-ref.sgml@@ -168,15 +168,10 @@ EOF
Specifies the name of the database to connect to. This is
equivalent to specifying <replaceable
class="parameter">dbname</replaceable> as the first non-option
- argument on the command line.- </para>- <para>- If this parameter contains an <symbol>=</symbol> sign or starts- with a valid <acronym>URI</acronym> prefix- (<literal>postgresql://</literal>- or <literal>postgres://</literal>), it is treated as a- <parameter>conninfo</parameter> string. See <xref- linkend="libpq-connstring"/> for more information.+ argument on the command line. <link+ linkend="libpq-connstring">Connction strings</link> can also be+ used for connection specifications, and these can override other+ command-line options.
</para>
</listitem>
</varlistentry>
@@ -498,7 +493,7 @@ EOF
<listitem>
<para>
Never issue a password prompt. If the server requires password
- authentication and a password is not available by other means+ authentication and a password is not available from other sources
such as a <filename>.pgpass</filename> file, the connection
attempt will fail. This option can be useful in batch jobs and
scripts where no user is present to enter a password.
@@ -518,13 +513,15 @@ EOF
<listitem>
<para>
Force <application>psql</application> to prompt for a
- password before connecting to a database.+ password before connecting to a database, even if the password will+ not be used.
</para>
<para>
- This option is never essential, since <application>psql</application>- will automatically prompt for a password if the server demands- password authentication. However, <application>psql</application>+ If the server requires password authentication and a password is not+ available from other sources such as a <filename>.pgpass</filename>+ file, <application>psql</application> will prompt for a+ password in any case. However, <application>psql</application>
will waste a connection attempt finding out that the server wants a
password. In some cases it is worth typing <option>-W</option> to avoid
the extra connection attempt.
diff --git a/doc/src/sgml/ref/reindexdb.sgml b/doc/src/sgml/ref/reindexdb.sgmlindex 026fd018d9..f8e27d82c2 100644--- a/doc/src/sgml/ref/reindexdb.sgml+++ b/doc/src/sgml/ref/reindexdb.sgml@@ -139,7 +139,9 @@ PostgreSQL documentation
<option>--all</option>) is not used, the database name is read
from the environment variable <envar>PGDATABASE</envar>. If
that is not set, the user name specified for the connection is
- used.+ used. <link linkend="libpq-connstring">Connction strings</link>+ can also be used for connection specifications, and these can+ override other command-line options.
</para>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/ref/vacuumdb.sgml b/doc/src/sgml/ref/vacuumdb.sgmlindex 95d6894cb0..04975656bb 100644--- a/doc/src/sgml/ref/vacuumdb.sgml+++ b/doc/src/sgml/ref/vacuumdb.sgml@@ -97,7 +97,9 @@ PostgreSQL documentation
<option>--all</option>) is not used, the database name is read
from the environment variable <envar>PGDATABASE</envar>. If
that is not set, the user name specified for the connection is
- used.+ used. <link linkend="libpq-connstring">Connction strings</link>+ can also be used for connection specifications, and these can+ override other command-line options.
</para>
</listitem>
</varlistentry>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: bruce@momjian.us, tgl@sss.pgh.pa.us, david.g.johnston@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #16486: Prompted password is ignored when password specified in connection string
In-Reply-To: <20200901203846.GA13613@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox