From: Peter Eisentraut <peter_e@gmx.net>
To: pgsql-hackers@postgresql.org
Cc: Magnus Hagander <mha@sollentuna.net>
Cc: Yoshiyuki Asaba <y-asaba@sraoss.co.jp>
Subject: Re: pg_dump -Ft failed on Windows XP
Date: Thu, 20 Apr 2006 12:45:26 +0200
Message-ID: <200604201245.27186.peter_e@gmx.net> (raw)
In-Reply-To: <6BCB9D8A16AC4241919521715F4D8BCEA352CE@algol.sollentuna.se>
References: <6BCB9D8A16AC4241919521715F4D8BCEA352CE@algol.sollentuna.se>
Am Donnerstag, 20. April 2006 10:47 schrieb Magnus Hagander:
> Indeed, that's definitly a bug. Quick patch attached. It does appear to
> work, but there may be a better way?
This patch introduces a security hole because an attacker could create, say, a
suitable symlink between the time the name is generated and the file is
opened.
--
Peter Eisentraut
http://developer.postgresql.org/~petere/
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: peter_e@gmx.net, mha@sollentuna.net, y-asaba@sraoss.co.jp
Subject: Re: pg_dump -Ft failed on Windows XP
In-Reply-To: <200604201245.27186.peter_e@gmx.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox