Re: Isn't pg_statistic a security hole?

> Hmm, that would work --- you could join against pg_class to find out the
> owner of the relation. While you were at it, maybe look up the
> attribute name in pg_attribute as well. Anyone want to propose a
> specific view definition?
>

How does this work?

create view pg_userstat as (
select
s.starelid
,s.staattnum
,s.staop
,s.stanullfrac
,s.stacommonfrac
,s.stacommonval
,s.staloval
,s.stahival
,c.relname
,a.attname
,sh.usename
from
pg_statistic as s
,pg_class as c
,pg_shadow as sh
,pg_attribute as a
where
(sh.usename=current_user or current_user='postgres')
and sh.usesysid = c.relowner
and a.attrelid = c.oid
and c.oid = s.starelid
);

-- Joe