Re: SECURITY: psql allows symlink games in /tmp

> Looks like what I would have done if I knew C.
>
> The only issue remaining is a policy issue as to if psql should call an
> editor in /tmp at all, considering the issues raised bye the recent joe
> vulnerability, ie can we trust the editor not to do a crazy thing, like
> not creating a similarly predictable backup-file name etc. It should at
> least be documented so that a more parinoid sys-admin can make sure that
> users use a private TMPDIR.

Not sure it is worth the addition.

--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 853-3000
+ If your life is a hard drive, | 830 Blythe Avenue
+ Christ can be your backup. | Drexel Hill, Pennsylvania 19026