Обсуждение: pg_dump & ownership (again)
Recent testing of the BLOB restoration code of pg_dump has highlighted something that *may* be a problem, but I am not sure. BLOBs create tables, and AFAICT those tables are owned by the user who was connected at the time. This theoretically means that even though a user has access to a table with a BLOB column, they may not be able to read the BLOB - is that right? Should I worry about this? ---------------------------------------------------------------- Philip Warner | __---_____ Albatross Consulting Pty. Ltd. |----/ - \ (A.C.N. 008 659 498) | /(@) ______---_ Tel: (+61) 0500 83 82 81 | _________ \ Fax: (+61) 0500 83 82 82 | ___________ | Http://www.rhyme.com.au | / \| | --________-- PGP key available upon request, | / and from pgp5.ai.mit.edu:11371 |/
Philip Warner <pjw@rhyme.com.au> writes: > Recent testing of the BLOB restoration code of pg_dump has highlighted > something that *may* be a problem, but I am not sure. BLOBs create tables, > and AFAICT those tables are owned by the user who was connected at the > time. This theoretically means that even though a user has access to a > table with a BLOB column, they may not be able to read the BLOB - is that > right? Should I worry about this? The BLOB access code contains no permissions checks --- which is likely a bug in itself, but anyway if you know the OID of a large object you can do anything you want to it via the lo_xxx functions. regards, tom lane
At 15:49 1/08/00 -0400, Tom Lane wrote: > >The BLOB access code contains no permissions checks --- which is likely >a bug in itself, but anyway if you know the OID of a large object you >can do anything you want to it via the lo_xxx functions. This is good to know; I really hope that a new BLOB implementation can come out of TOAST, and get rid of this mess ASAP... ---------------------------------------------------------------- Philip Warner | __---_____ Albatross Consulting Pty. Ltd. |----/ - \ (A.C.N. 008 659 498) | /(@) ______---_ Tel: (+61) 0500 83 82 81 | _________ \ Fax: (+61) 0500 83 82 82 | ___________ | Http://www.rhyme.com.au | / \| | --________-- PGP key available upon request, | / and from pgp5.ai.mit.edu:11371 |/