lo and security

From: "Thomas T(dot) Thai" <tom(at)minnesota(dot)com>
To: PostgreSQL General <pgsql-general(at)postgresql(dot)org>
Subject: lo and security
Date: 2001-05-18 07:59:13
Message-ID: Pine.NEB.4.21.0105180254300.17302-100000@ns01.minnesota.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

i'm making a photo album app with php4 and pgsql. i came across something
i think could be a security risk.

i have a web page with a form for user to upload their image, then using
INSERT and lo_import() i get the file to the right location. the problem
is this, with one postmaster running as uid pgsql, that would allow any
other developer to view my data just by guessing the path to my images
cause they all get read by user pgsql.

how do i circumvent this?

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Einar Karttunen 2001-05-18 08:14:36 Re: lo and security
Previous Message Vikaas BV 2001-05-18 07:15:14 Size of Postgres Transaction Logs