5488 Commits (acf40f39be47cd92ff394e9c42f9ffa4dfd741ed)

Author	SHA1	Message	Date
Tom Lane	f39fc4769e	Stamp release 8.0.8.	20 years ago
Tom Lane	e35c0aee33	Update release notes for upcoming releases.	20 years ago
Bruce Momjian	29dd673a94	Stamp releases 7.3.15, 7.4.13, and 8.0.8.	20 years ago
Tom Lane	94dec9114b	Modify libpq's string-escaping routines to be aware of encoding considerations ... and standard_conforming_strings. The encoding changes are needed for proper escaping in multibyte encodings, as per the SQL-injection vulnerabilities noted in CVE-2006-2313 and CVE-2006-2314. Concurrent fixes are being applied to the server to ensure that it rejects queries that may have been corrupted by attempted SQL injection, but this merely guarantees that unpatched clients will fail rather than allow injection. An actual fix requires changing the client-side code. While at it we have also fixed these routines to understand about standard_conforming_strings, so that the upcoming changeover to SQL-spec string syntax can be somewhat transparent to client code. Since the existing API of PQescapeString and PQescapeBytea provides no way to inform them which settings are in use, these functions are now deprecated in favor of new functions PQescapeStringConn and PQescapeByteaConn. The new functions take the PGconn to which the string will be sent as an additional parameter, and look inside the connection structure to determine what to do. So as to provide some functionality for clients using the old functions, libpq stores the latest encoding and standard_conforming_strings values received from the backend in static variables, and the old functions consult these variables. This will work reliably in clients using only one Postgres connection at a time, or even multiple connections if they all use the same encoding and string syntax settings; which should cover many practical scenarios. Clients that use homebrew escaping methods, such as PHP's addslashes() function or even hardwired regexp substitution, will require extra effort to fix :-(. It is strongly recommended that such code be replaced by use of PQescapeStringConn/PQescapeByteaConn if at all feasible.	20 years ago
Tom Lane	9bc62ddd5f	Add a new GUC parameter backslash_quote, which determines whether the SQL ... parser will allow "\'" to be used to represent a literal quote mark. The "\'" representation has been deprecated for some time in favor of the SQL-standard representation "''" (two single quote marks), but it has been used often enough that just disallowing it immediately won't do. Hence backslash_quote allows the settings "on", "off", and "safe_encoding", the last meaning to allow "\'" only if client_encoding is a valid server encoding. That is now the default, and the reason is that in encodings such as SJIS that allow 0x5c (ASCII backslash) to be the last byte of a multibyte character, accepting "\'" allows SQL-injection attacks as per CVE-2006-2314 (further details will be published after release). The "on" setting is available for backward compatibility, but it must not be used with clients that are exposed to untrusted input. Thanks to Akio Ishida and Yasuo Ohgaki for identifying this security issue.	20 years ago
Tom Lane	2d584b5c1b	Update release notes.	21 years ago
Bruce Momjian	9bb401cd73	Update FAQ latest version	21 years ago
Bruce Momjian	5ae9c6138b	Stamp releases for 2006-02-14 release	21 years ago
Bruce Momjian	dfa879bc98	Update release notes for 2006-02-14 release	21 years ago
Tom Lane	a14302080f	Reject out-of-range dates in date_in(). ... Kris Jurka	21 years ago
Tom Lane	e82858f013	Release-note updates and copy editing.	21 years ago
Bruce Momjian	0add52b4f6	New pgcrypto item wording.	21 years ago
Bruce Momjian	240fb6dd4f	Wording improvements.	21 years ago
Bruce Momjian	4011909a02	Improve markup.	21 years ago
Bruce Momjian	748a71fbff	Update release notes.	21 years ago
Bruce Momjian	2a35aedd97	Stamp relesae 8.0.6.	21 years ago
Tom Lane	499dad06f2	Stamp 8.0.5.	21 years ago
Tom Lane	9e127658f2	Add release notes for back branches (7.3 and up). ... Also minor improvements to 8.1.1 release notes.	21 years ago
Peter Eisentraut	bd760bf800	Documentation fix: s/event_object_name/event_object_table/g	21 years ago
Tom Lane	b0be56634b	Fix obsolete description of -h option, per Andreas Schmidt.	21 years ago
Bruce Momjian	f583cbc8a0	Properly document return value of strpos().	21 years ago
Bruce Momjian	56f68ed907	Backpatch FAQ's for 8.0.X.	21 years ago
Bruce Momjian	8f03406ee9	Update AIX FAQ, backpatch.	21 years ago
Neil Conway	20f5a328e5	Backpatch merge_db() example for PL/PgSQL to 8.0. Patch from David ... Fetter, fixes by Neil Conway.	21 years ago
Bruce Momjian	ce150c4a8b	Update Japanese FAQ. ... Jun Kuwamura	21 years ago
Bruce Momjian	b0db380b09	Update version number in faq.	21 years ago
Bruce Momjian	2a3f44b769	Update FAQ's in 8.0.X branch. (very small changes)	21 years ago
Bruce Momjian	610a7c6fdc	Add FAQ_hungarian.html to 8.0.X branch.	21 years ago
Tom Lane	3dfec7f73e	COPY's test for read-only transaction was backward; it prohibited COPY TO ... where it should prohibit COPY FROM. Found by Alon Goldshuv.	21 years ago
Tom Lane	73a71f50cd	Stamp release 8.0.4.	21 years ago
Tom Lane	65ae842791	Update release notes for pending back-branch releases.	21 years ago
Bruce Momjian	0326d705ab	Update Russian FAQ. ... Victor Vislobokov	21 years ago
Bruce Momjian	9516724bd7	Update FAQ's in 8.0.X branch.	21 years ago
Neil Conway	3926b6e9c3	Fix a mistake in the documentation for SPI_getbinval(), per Michael Fuhr.	21 years ago
Bruce Momjian	9a6f3630cf	Fix typo: ... sql_information_info -> sql_implementation_info Robert Treat	21 years ago
Bruce Momjian	18e615979e	Backpatch new CVS home page URL.	21 years ago
Bruce Momjian	61dc3df71f	Update AIX FAQ. ... Chris Browne	21 years ago
Tom Lane	894889ecc4	Force a checkpoint before committing a CREATE DATABASE command. This ... should fix the recent reports of "index is not a btree" failures, as well as preventing a more obscure race condition involving changes to a template database just after copying it with CREATE DATABASE.	21 years ago
Bruce Momjian	9f64e10225	NetBSD uses "options" not "option".	21 years ago
Tom Lane	887a7255d1	Repair error in description of nonblocking usage of PQgetCopyData(). ... Per Volkan Yazici.	21 years ago
Bruce Momjian	272f23c814	Update Chinese FAQ to fix XHTML format. ... Weiping (Laser)	21 years ago
Bruce Momjian	1d03f3f027	Update Russian FAQ. ... Viktor Vislobokov	21 years ago
Bruce Momjian	1b46bcc0c3	Update Farsi FAQ. ... Mahmoud Taghizadeh	21 years ago
Bruce Momjian	29167dd3d7	Update Japanese FAQ. ... Jun Kuwamura	21 years ago
Neil Conway	621d5e1d72	Fix typo in ECPG docs, per Andreas Seltenreich.	21 years ago
Bruce Momjian	ba5684691c	Convert Chinese FAQ to valid XHTML, finally.	21 years ago
Bruce Momjian	c23e15cd42	Fix Chinese markup some more.	21 years ago
Bruce Momjian	390d460138	Update Chinese FAQ to xhtml.	21 years ago
Tom Lane	011af314b7	Add missing quote, per Dave Page.	21 years ago
Tom Lane	69664f11af	Fix broken markup.	21 years ago