pgsql: Disable the undocumented xmlvalidate() function, which was

From: tgl(at)postgresql(dot)org (Tom Lane)
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: Disable the undocumented xmlvalidate() function, which was
Date: 2008-03-01 02:46:49
Message-ID: 20080301024649.3CDCD754108@cvs.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Log Message:
-----------
Disable the undocumented xmlvalidate() function, which was unintentionally
left in the code though it was not meant to be provided. It represents a
security hole because unprivileged users could use it to look at (at least the
first line of) any file readable by the backend. Fortunately, this is only
possible if the backend was built with XML support, so the damage is at least
mitigated; and 8.3 probably hasn't propagated into any security-critical uses
yet anyway. Per report from Sergey Burladyan.

Modified Files:
--------------
pgsql/src/backend/utils/adt:
xml.c (r1.68 -> r1.69)
(http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/adt/xml.c?r1=1.68&r2=1.69)

Browse pgsql-committers by date

  From Date Subject
Next Message Tom Lane 2008-03-01 02:46:55 pgsql: Disable the undocumented xmlvalidate() function, which was
Previous Message Andrew Dunstan 2008-02-29 23:31:57 pgsql: Don't call AddUserToDacl on Cygwin