Re: Feature request dblink: Security issue - dblink user+password parameters must be optional

From: Marko Kreen <markokr(at)gmail(dot)com>
To: Hermann Muster <Hermann(dot)Muster(at)gmx(dot)de>
Cc: pgsql-general(at)postgresql(dot)org
Subject: Re: Feature request dblink: Security issue - dblink user+password parameters must be optional
Date: 2009-01-28 09:07:14
Message-ID: e51f66da0901280107p78cba189xa85f6a09ad41e3a2@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

On 1/28/09, Hermann Muster <Hermann(dot)Muster(at)gmx(dot)de> wrote:
> When creating a view via DBLINK, the user=... and password=... parameters
> shall be optional. If they are left out, then the current user accessing the
> view shall be impersonated implicitely to the "dblinked" database as well.
> Forcing anybody to hardcode a password readable within the view definition
> should be an absolute DON'T!
>
> Haven't found a better place to post this request. Hope the author of
> dblink is reading it here, too. :-)

I think this will be properly fixed by SQL-MED connection handling in 8.4.

In older version maybe you can use wrapper function around dblink
that constructs per-user connect string.

--
marko

In response to

Browse pgsql-general by date

  From Date Subject
Next Message Dave Page 2009-01-28 09:18:33 Re: About PostgreSQL Installer
Previous Message Philippe Lang 2009-01-28 08:43:23 Killing an offending process without restarting Postgresql safe?