From: Richard Huxton <dev@archonet.com>
To: Denis <sqllist@coralindia.com>
To: pgsql-sql@postgresql.org
Subject: Re: how to preserve \n in select statement
Date: Mon, 22 Dec 2003 10:48:20 +0000
Message-ID: <200312221048.20783.dev@archonet.com> (raw)
In-Reply-To: <004c01c3c86f$389c5380$0f32a8c0@denisnew>
References: <BAY9-F42t0CI76rOJhK00098f93@hotmail.com>
<200312220904.11730.dev@archonet.com>
<004c01c3c86f$389c5380$0f32a8c0@denisnew>
On Monday 22 December 2003 09:37, Denis wrote:
> Hi Richard..
>
> If your users are required to fire only SELECT and no DML, you can do the
> following:
>
> BEGIN;
> execute the statements given by user
> ROLLBACK;
>
> This will not affect your SELECT and also if any malicious user gives
> DELETE statement, that will not have any impact too..
An interesting idea, though you'd need to be careful with side-effects
(triggers/functions etc). I seem to recall a "read-only" setting being
discussed for transactions too (though not as a security measure, I should
emphasise).
The other thing is to use the database user/group mechanism - something which
tends to be neglected with web-based apps (partly because different DBs have
different setups here).
If only an application super-user can add/delete users make sure the
permissions reflect this and connect as a more restricted user for other
logins.
--
Richard Huxton
Archonet Ltd
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: dev@archonet.com, sqllist@coralindia.com
Subject: Re: how to preserve \n in select statement
In-Reply-To: <200312221048.20783.dev@archonet.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox