Date: Mon, 31 Mar 2008 18:22:47 -0400
From: Alvaro Herrera <alvherre@commandprompt.com>
To: Dave Page <dpage@pgadmin.org>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Lars Olson <leolson1@uiuc.edu>,
	pgsql-bugs@postgresql.org
Subject: Re: BUG #4074: Using SESSION_USER or CURRENT_USER in a view
	definition is unsafe
Message-ID: <20080331222247.GI24048@alvh.no-ip.org>
References: <200803312055.m2VKtmdb090699@wwwmaster.postgresql.org>
	<24862.1207000008@sss.pgh.pa.us>
	<937d27e10803311504ib836b4bp814f592325304fd6@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <937d27e10803311504ib836b4bp814f592325304fd6@mail.gmail.com>
User-Agent: Mutt/1.5.17+20080114 (2008-01-14)

Dave Page wrote:
> On Mon, Mar 31, 2008 at 10:46 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> >  If this were a security issue, you already spilled the beans by
> >  reporting it to a public mailing list; so I'm unsure what you are
> >  concerned about.
> 
> I'd wager that Lars didn't realise the bug form goes straight to the
> list. We should probably make that more clear.
> 
> On the other hand it does say to report security issues to security@...

Let's have a checkbox "I am reporting a security issue" and send the
mail to security@ if checked.

-- 
Alvaro Herrera                                http://www.CommandPrompt.com/
The PostgreSQL Company - Command Prompt, Inc.