| From: | Bruce Momjian <bruce(at)momjian(dot)us> |
|---|---|
| To: | Magnus Hagander <magnus(at)hagander(dot)net> |
| Cc: | Chander Ganesan <chander(at)otg-nc(dot)com>, pgsql-hackers(at)postgresql(dot)org |
| Subject: | Re: LISTEN/NOTIFY Security and the docs |
| Date: | 2012-08-30 01:45:57 |
| Message-ID: | 20120830014557.GI8753@momjian.us |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Thu, May 24, 2012 at 01:03:18PM +0200, Magnus Hagander wrote:
> On Fri, May 18, 2012 at 5:08 PM, Chander Ganesan <chander(at)otg-nc(dot)com> wrote:
> > Hi All,
> >
> > I just realized that anyone can listen for notifications (using listen) so
> > long as they know the "channel" name. This means that a user could receive
> > and view the payload for another user.
> >
> > Perhaps it would be good to note this in the documentation (i.e., there
> > should be no expectation of privacy/security when using listen/notify, so
> > any user that can connect to a database could issue and receive
> > notifications for any channel.)
>
> Might be worth a note, yes. The lack of a note really should tell you
> that it's a broadcast, but it wouldn't hurt to have an extra one.
>
> Want to prepare a patch?
Attached documentation patch applied.
--
Bruce Momjian <bruce(at)momjian(dot)us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ It's impossible for everything to be true. +
| Attachment | Content-Type | Size |
|---|---|---|
| notify.diff | text/x-diff | 856 bytes |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Stephen Frost | 2012-08-30 01:46:06 | Re: Pre-alloc ListCell's optimization |
| Previous Message | Bruce Momjian | 2012-08-30 01:30:26 | Re: Pre-alloc ListCell's optimization |