You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Noah Misch 286c8bc646 Obstruct shell, SQL, and conninfo injection via database and role names. ... Due to simplistic quoting and confusion of database names with conninfo strings, roles with the CREATEDB or CREATEROLE option could escalate to superuser privileges when a superuser next ran certain maintenance commands. The new coding rule for PQconnectdbParams() calls, documented at conninfo_array_parse(), is to pass expand_dbname=true and wrap literal database names in a trivial connection string. Escape zero-length values in appendConnStrVal(). Back-patch to 9.1 (all supported versions). Nathan Bossart, Michael Paquier, and Noah Misch. Reviewed by Peter Eisentraut. Reported by Nathan Bossart. Security: CVE-2016-5424		10 years ago
..
backend	Fix misestimation of n_distinct for a nearly-unique column with many nulls.	10 years ago
bin	Obstruct shell, SQL, and conninfo injection via database and role names.	10 years ago
common	…
include	Fix misestimation of n_distinct for a nearly-unique column with many nulls.	10 years ago
interfaces	Obstruct shell, SQL, and conninfo injection via database and role names.	10 years ago
makefiles	…
pl	Make pltcl regression tests safe for Danish locale.	10 years ago
port	Stamp 9.5.3.	10 years ago
template	…
test	Don't CHECK_FOR_INTERRUPTS between WaitLatch and ResetLatch.	10 years ago
timezone	Update time zone data files to tzdata release 2016f.	10 years ago
tools	Obstruct shell, SQL, and conninfo injection via database and role names.	10 years ago
tutorial	…
.gitignore	…
DEVELOPERS	…
Makefile	…
Makefile.global.in	Back-patch fixes to make TAP tests work on Windows.	10 years ago
Makefile.shlib	Make the AIX case of Makefile.shlib safe for parallel make.	10 years ago
bcc32.mak	…
nls-global.mk	nls-global.mk: search build dir for source files, too	10 years ago
win32.mak	…