X-Original-To: pgsql-hackers-postgresql.org@localhost.postgresql.org Received: from localhost (mx2.hub.org [200.46.204.254]) by postgresql.org (Postfix) with ESMTP id 6FFE711F6D5E for ; Thu, 20 Apr 2006 07:45:46 -0300 (ADT) X-Virus-Scanned: by amavisd-new at hub.org X-Spam-Score: -1.636 X-Spam-Level: X-Spam-Status: No, score=-1.636 required=5 tests=[AWL=-0.314, BAYES_00=-2.599, FORGED_RCVD_HELO=0.135, SPF_FAIL=1.142] Received: from postgresql.org ([200.46.204.71]) by localhost (mx2.hub.org [200.46.204.254]) (amavisd-new, port 10024) with ESMTP id OshvhB+Uolza for ; Thu, 20 Apr 2006 07:45:40 -0300 (ADT) X-Greylist: from auto-whitelisted by SQLgrey- Received: from gauss.credativ.com (ipx11302.ipxserver.de [212.112.227.254]) by postgresql.org (Postfix) with ESMTP id 68D6B11F6C80 for ; Thu, 20 Apr 2006 07:45:38 -0300 (ADT) Received: from bell.credativ.de (p508952CC.dip.t-dialin.net [80.137.82.204]) (using TLSv1 with cipher EXP1024-RC4-SHA (56/128 bits)) (No client certificate requested) by gauss.credativ.com (Postfix) with ESMTP id D019DD75ED; Thu, 20 Apr 2006 12:45:33 +0200 (CEST) From: Peter Eisentraut To: pgsql-hackers@postgresql.org Subject: Re: pg_dump -Ft failed on Windows XP Date: Thu, 20 Apr 2006 12:45:26 +0200 User-Agent: KMail/1.9.1 Cc: "Magnus Hagander" , "Yoshiyuki Asaba" References: <6BCB9D8A16AC4241919521715F4D8BCEA352CE@algol.sollentuna.se> In-Reply-To: <6BCB9D8A16AC4241919521715F4D8BCEA352CE@algol.sollentuna.se> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200604201245.27186.peter_e@gmx.net> X-Archive-Number: 200604/708 X-Sequence-Number: 82431 Am Donnerstag, 20. April 2006 10:47 schrieb Magnus Hagander: > Indeed, that's definitly a bug. Quick patch attached. It does appear to > work, but there may be a better way? This patch introduces a security hole because an attacker could create, say, a suitable symlink between the time the name is generated and the file is opened. -- Peter Eisentraut http://developer.postgresql.org/~petere/