From: Chris Travers <chris@travelamericas.com>
To: pgsql-sql@postgresql.org
Subject: SECURITY DEFINER changes CURRENT_USER?
Date: Sat, 19 Jul 2003 22:07:34 -0700
Message-ID: <3F1A2396.4050907@travelamericas.com> (raw)
Hi all;
I found an unexpected behavior while trying to write a function to allow
users to change their own passwords. The function is as follows:
CREATE OR REPLACE FUNCTION change_password(VARCHAR)
RETURNS BOOL AS '
DECLARE
username VARCHAR;
CMD VARCHAR;
password ALIAS FOR $1;
BEGIN
SELECT INTO username CURRENT_USER;
CMD := ''ALTER USER '' || username || '' WITH PASSWORD '';
CMD := CMD || '''''''' || password || '''''''';
EXECUTE CMD;
RETURN TRUE;
end;
' LANGUAGE 'plpgsql' VOLATILE SECURITY DEFINER
I would expect this to change the password of the user currently logged
in but instead it changes MY password. Evidently when a function is
called which is set to SECURITY DEFINER, it changes the context of the
current user. The CURRENT_USER then returns the name of the definer
rather than the invoker of the function.
So this being said-- are there any workarounds that don't allow anyone
to change anyone else's password?
Best Wishes,
Chris Travers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: chris@travelamericas.com
Subject: Re: SECURITY DEFINER changes CURRENT_USER?
In-Reply-To: <3F1A2396.4050907@travelamericas.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox