You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Noah Misch a2385cac13 Obstruct shell, SQL, and conninfo injection via database and role names. ... Due to simplistic quoting and confusion of database names with conninfo strings, roles with the CREATEDB or CREATEROLE option could escalate to superuser privileges when a superuser next ran certain maintenance commands. The new coding rule for PQconnectdbParams() calls, documented at conninfo_array_parse(), is to pass expand_dbname=true and wrap literal database names in a trivial connection string. Escape zero-length values in appendConnStrVal(). Back-patch to 9.1 (all supported versions). Nathan Bossart, Michael Paquier, and Noah Misch. Reviewed by Peter Eisentraut. Reported by Nathan Bossart. Security: CVE-2016-5424		9 years ago
..
.gitignore	Convert cvsignore to gitignore, and add .gitignore for build targets.	15 years ago
IMPLEMENTATION	Remove useless whitespace at end of lines	15 years ago
Makefile	Convert contrib modules to use the extension facility.	15 years ago
TESTING	Remove useless whitespace at end of lines	15 years ago
check.c	Obstruct shell, SQL, and conninfo injection via database and role names.	9 years ago
controldata.c	Fix spelling mistake.	10 years ago
dump.c	Obstruct shell, SQL, and conninfo injection via database and role names.	9 years ago
exec.c	Remove tabs after spaces in C comments	12 years ago
file.c	pg_upgrade: fix CopyFile() on Windows to fail on file existence	10 years ago
function.c	In pg_upgrade, report pre-PG 8.1 plpython helper functions left in the	14 years ago
info.c	pg_dump, pg_upgrade: allow postgres/template1 tablespace moves	10 years ago
option.c	Obstruct shell, SQL, and conninfo injection via database and role names.	9 years ago
page.c	Remove tabs after spaces in C comments	12 years ago
pg_upgrade.c	Obstruct shell, SQL, and conninfo injection via database and role names.	9 years ago
pg_upgrade.h	Obstruct shell, SQL, and conninfo injection via database and role names.	9 years ago
relfilenode.c	Remove tabs after spaces in C comments	12 years ago
server.c	Obstruct shell, SQL, and conninfo injection via database and role names.	9 years ago
tablespace.c	pgindent run before PG 9.1 beta 1.	15 years ago
util.c	Obstruct shell, SQL, and conninfo injection via database and role names.	9 years ago
version.c	Obstruct shell, SQL, and conninfo injection via database and role names.	9 years ago
version_old_8_3.c	Obstruct shell, SQL, and conninfo injection via database and role names.	9 years ago