Unauthorized users can see db schema and read functions

From: "Willy-Bas Loos" <willybas(at)gmail(dot)com>
To: pgsql-general(at)postgresql(dot)org
Subject: Unauthorized users can see db schema and read functions
Date: 2007-01-30 08:40:44
Message-ID: 1dd6057e0701300040s116d70e0ufabcda0bdb3aa32b@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

Hi,

I've noticed that any user who can logon to a db cluster can read the schema
of all databases in it, including the code of all plpgsql functions. Even in
schema's he/she doesn't have access to. For tables it just says 'access
denied for schema bla', after which the structure is still shown to the
user. For functions, there is no warning at all, you can just read (copy,
paste) away.
I use pgAdmin3 1.6.2 as a front-end for both linux and windows servers, but
I don't think restricting schema information should be a front-end
responsibility.

o Why is schema information not restricted?
o Is there any way to prevent this, other than starting another cluster for
this user's database

thx!

Willy-Bas

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Joris Dobbelsteen 2007-01-30 09:32:34 Re: Unauthorized users can see db schema and read functions
Previous Message Peter 2007-01-30 08:32:10 Re: PostgreSQL 9.0