pg.ddx.io pgsql-docs@postgresql.org mailing list archivehelp / color / mirror / Atom feed
"$user" and SESSION_USER and CURRENT_USER 2+ messages / 2 participants [nested] [flat]
Commits from this thread: 2018-12-20 42bdf853f6 4e4c0d6686 e13d8a783d dae1db34f5 773e2d29cd 164d439550 Doc: fix ancient mistake in search_path documentation.
* "$user" and SESSION_USER and CURRENT_USER @ 2018-12-20 15:38 antonov@stdpr.ru 2018-12-20 18:42 ` Re: "$user" and SESSION_USER and CURRENT_USER Tom Lane <tgl@sss.pgh.pa.us> 0 siblings, 1 reply; 2+ messages in thread From: antonov@stdpr.ru @ 2018-12-20 15:38 UTC (permalink / raw) To: pgsql-docs hi, sorry for my message. I'm tiny confused about the next one. could you help me?: here -- https://www.postgresql.org/docs/11/runtime-config-client.html there is the text """If one of the list items is the special name $user, then the schema having the name returned by SESSION_USER is substituted, if there is such a schema and the user has USAGE permission for it. (If not, $user is ignored.)""". but actualy "$user" substitutes CURRENT_USER-value (not SESSION_USER-value). it's good because it would be a SECURITY VULNERABILITY if "$user" substituted SESSION_USER-value (in conjunction with security definer functions). in case of CURRENT_USER-value we have no the vulnerable. which is good :-) but is there error in documentation text (runtime-config-client.html) , isn't? thank you in advance. ^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: "$user" and SESSION_USER and CURRENT_USER 2018-12-20 15:38 "$user" and SESSION_USER and CURRENT_USER antonov@stdpr.ru @ 2018-12-20 18:42 ` Tom Lane <tgl@sss.pgh.pa.us> 0 siblings, 0 replies; 2+ messages in thread From: Tom Lane @ 2018-12-20 18:42 UTC (permalink / raw) To: antonov@stdpr.ru; +Cc: pgsql-docs antonov@stdpr.ru writes: > here -- https://www.postgresql.org/docs/11/runtime-config-client.html > there is the text """If one of the list items is the special name $user, > then the schema having the name returned by SESSION_USER is substituted, > if there is such a schema and the user has USAGE permission for it. (If > not, $user is ignored.)""". > but actualy "$user" substitutes CURRENT_USER-value (not > SESSION_USER-value). Huh. Digging in the commit history, SESSION_USER was the original implementation (commit 838fe25a9 of 2002-04-01) but it was changed later that month (ccfaf9067 of 2002-04-29) when we added schema permissions checks. Evidently I forgot to update the docs to match :-( Will fix, thanks for noticing! regards, tom lane ^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2018-12-20 18:42 UTC | newest] Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2018-12-20 15:38 "$user" and SESSION_USER and CURRENT_USER antonov@stdpr.ru 2018-12-20 18:42 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox