3618 Commits (af6b2e30a463600a559700a67d1a97c0b2413258)

Author	SHA1	Message	Date
Bruce Momjian	af6b2e30a4	Stamp releases 8.2.4, 8.1.9, 8.0.13, 7.4.17, 7.3.19.	19 years ago
Bruce Momjian	28ecd60233	Release note updates for 8.2.4, 8.1.9, 8.0.13, 7.4.17, 7.3.19.	19 years ago
Tom Lane	af8a424324	Stamp release 7.3.18. ... Security: CVE-2007-0555, CVE-2007-0556	19 years ago
Tom Lane	c07313161f	Update release notes for security-related releases in all active branches. ... Security: CVE-2007-0555, CVE-2007-0556	19 years ago
Bruce Momjian	4c884c3ceb	Fix markup because older releases couldn't like to refernce pages.	19 years ago
Bruce Momjian	43a9728290	Fix markup because lc_numeric didn't have an SGML tag in this release.	19 years ago
Tom Lane	3941045cd3	Minor copy-editing for release note updates.	19 years ago
Bruce Momjian	3294607a6a	Stamp release 7.3.17.	19 years ago
Bruce Momjian	4f58c0db22	Create release notes for 7.3.17.	19 years ago
Tom Lane	9dd224e3c6	A bit of copy-editing on back-branch release notes.	19 years ago
Bruce Momjian	68b856f065	Stamp releases 7.3.16, 7.4.14, 8.0.9, and 8.1.5.	19 years ago
Bruce Momjian	850f5f3287	Update release notes for releases 7.3.16, 7.4.14, 8.0.9, and 8.1.5.	19 years ago
Tom Lane	e675978ff5	Stamp release 7.3.15.	20 years ago
Tom Lane	78e237e1e3	Update release notes for upcoming releases.	20 years ago
Bruce Momjian	502b68876c	Stamp releases 7.3.15, 7.4.13, and 8.0.8.	20 years ago
Tom Lane	e6f43f7786	Modify libpq's string-escaping routines to be aware of encoding considerations ... and standard_conforming_strings. The encoding changes are needed for proper escaping in multibyte encodings, as per the SQL-injection vulnerabilities noted in CVE-2006-2313 and CVE-2006-2314. Concurrent fixes are being applied to the server to ensure that it rejects queries that may have been corrupted by attempted SQL injection, but this merely guarantees that unpatched clients will fail rather than allow injection. An actual fix requires changing the client-side code. While at it we have also fixed these routines to understand about standard_conforming_strings, so that the upcoming changeover to SQL-spec string syntax can be somewhat transparent to client code. Since the existing API of PQescapeString and PQescapeBytea provides no way to inform them which settings are in use, these functions are now deprecated in favor of new functions PQescapeStringConn and PQescapeByteaConn. The new functions take the PGconn to which the string will be sent as an additional parameter, and look inside the connection structure to determine what to do. So as to provide some functionality for clients using the old functions, libpq stores the latest encoding and standard_conforming_strings values received from the backend in static variables, and the old functions consult these variables. This will work reliably in clients using only one Postgres connection at a time, or even multiple connections if they all use the same encoding and string syntax settings; which should cover many practical scenarios. Clients that use homebrew escaping methods, such as PHP's addslashes() function or even hardwired regexp substitution, will require extra effort to fix :-(. It is strongly recommended that such code be replaced by use of PQescapeStringConn/PQescapeByteaConn if at all feasible.	20 years ago
Tom Lane	16e77740ea	Add a new GUC parameter backslash_quote, which determines whether the SQL ... parser will allow "\'" to be used to represent a literal quote mark. The "\'" representation has been deprecated for some time in favor of the SQL-standard representation "''" (two single quote marks), but it has been used often enough that just disallowing it immediately won't do. Hence backslash_quote allows the settings "on", "off", and "safe_encoding", the last meaning to allow "\'" only if client_encoding is a valid server encoding. That is now the default, and the reason is that in encodings such as SJIS that allow 0x5c (ASCII backslash) to be the last byte of a multibyte character, accepting "\'" allows SQL-injection attacks as per CVE-2006-2314 (further details will be published after release). The "on" setting is available for backward compatibility, but it must not be used with clients that are exposed to untrusted input. Thanks to Akio Ishida and Yasuo Ohgaki for identifying this security issue.	20 years ago
Tom Lane	ee7c1a3fd4	Update release notes.	20 years ago
Bruce Momjian	da91fde3e8	Update FAQ latest version	20 years ago
Bruce Momjian	c551fd362e	Stamp releases for 2006-02-14 release	20 years ago
Bruce Momjian	db4534e31f	Update release notes for 2006-02-14 release	20 years ago
Tom Lane	751c4818bf	Release-note updates and copy editing.	20 years ago
Bruce Momjian	a93eb7cef2	New pgcrypto item wording.	20 years ago
Bruce Momjian	e6e13b5da9	Wording improvements.	20 years ago
Bruce Momjian	7251950412	Improve markup.	20 years ago
Bruce Momjian	00214b611c	*** empty log message ***	20 years ago
Bruce Momjian	44a3ad2ab0	Stamp release 7.3.13.	20 years ago
Tom Lane	fbb687fa1b	Stamp 7.3.12.	20 years ago
Tom Lane	52d70a3088	Add release notes for back branches (7.3 and up). ... Also minor improvements to 8.1.1 release notes.	20 years ago
Bruce Momjian	62b91ec937	Properly document return value of strpos().	20 years ago
Tom Lane	ae049f191d	Stamp release 7.3.11.	21 years ago
Tom Lane	69fbf4816b	Update release notes for pending back-branch releases.	21 years ago
Tom Lane	e5921b3230	Update release notes for upcoming re-releases.	21 years ago
Tom Lane	07e3879c95	Stamp release 7.3.10.	21 years ago
Tom Lane	ecbc6dd3e9	Alter the signature for encoding conversion functions to declare the ... output area as INTERNAL not CSTRING. This is to prevent people from calling the functions by hand. This is a permanent solution for the back branches but I hope it is just a stopgap for HEAD.	21 years ago
Tom Lane	d40cda00f5	Recommend security@postgresql.org as the contact point for security-related bugs.	21 years ago
Tom Lane	7929303d61	Stamp release 7.3.9.	21 years ago
Tom Lane	42a8068b5c	Stamp release 7.3.8.	21 years ago
Tom Lane	1bc489bc9c	Stamp 7.3.7.	22 years ago
Tom Lane	2d558b2baa	Brand 7.3.6.	22 years ago
Tom Lane	040f11db24	Update release notes for 7.3.6.	22 years ago
Tom Lane	d367707827	Replace unportable use of /dev/stdin with lynx's -stdin switch.	22 years ago
Tom Lane	7af352f103	Brand 7.3.5.	22 years ago
Tom Lane	3299a092e2	Update release notes for 7.3.5.	22 years ago
Joe Conway	8582f21afd	Make PQescapeBytea and byteaout consistent with each other, and ... octal escape all octets outside the range 0x20 to 0x7e. This fixes the problem pointed out by Sergey Yatskevich here: http://archives.postgresql.org/pgsql-bugs/2003-11/msg00140.php	22 years ago
Bruce Momjian	5a8e537441	Add Hungarian/Turkish FAQ's to 7.3.4.	23 years ago
Bruce Momjian	0878a5e277	Add to 7.3.4 release notes: ... * Repair breakage in timestamp-to-date conversion for dates before 2000	23 years ago
Bruce Momjian	97dcee285b	New WAL fix release text is: ... Prevent rare possibility of server startup failure (Tom)	23 years ago
Bruce Momjian	79b0da6e7c	Update all FAQ's for 7.3.4.	23 years ago
Bruce Momjian	1ecc0fdb00	Stamp 7.3.4 release.	23 years ago