agora inbox for pgsql-docs@postgresql.org
help / color / mirror / Atom feedFrom: PG Doc comments form <noreply@postgresql.org>
To: pgsql-docs@lists.postgresql.org
Cc: zack02469@yahoo.com
Subject: Does NOTIFY leak information?
Date: Wed, 04 Dec 2024 00:02:10 +0000
Message-ID: <173327053032.2556775.7769678074539788118@wrigleys.postgresql.org> (raw)
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/17/sql-notify.html
Description:
Hi,
The documentation (https://www.postgresql.org/docs/17/sql-notify.html) for
the NOTIFY command begins with the following statements:
The NOTIFY command sends a notification event together with an optional
“payload” string to each client application that has previously executed
LISTEN channel for the specified channel name in the current database.
Notifications are visible to all users.
I am interpreting this to mean that if I as user A receive a notification to
a channel that I have set up, then user B and user C will also see this
notification, irrespective of their various permissions. Am I understanding
this correctly, and if so, doesn't this qualify as an information leak?
view thread (3+ messages) latest in thread
Message-ID: <173327053032.2556775.7769678074539788118@wrigleys.postgresql.org>
Permalink: ../173327053032.2556775.7769678074539788118@wrigleys.postgresql.org/
Also on: postgresql.org/message-id/173327053032.2556775.7769678074539788118@wrigleys.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: noreply@postgresql.org, pgsql-docs@lists.postgresql.org, zack02469@yahoo.com
Subject: Re: Does NOTIFY leak information?
In-Reply-To: <173327053032.2556775.7769678074539788118@wrigleys.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox