Re: MAINTAIN privilege -- what do we need to un-revert it?
Jeff Davis <pgsql@j-davis.com>
From: Jeff Davis <pgsql@j-davis.com>
To: Noah Misch <noah@leadboat.com>
Cc: Michael Paquier <michael@paquier.xyz>, Nathan Bossart <nathandbossart@gmail.com>, pgsql-hackers@postgresql.org, Joe Conway <mail@joeconway.com>, Robert Haas <robertmhaas@gmail.com>
Date: 2024-07-12T23:50:17Z
Lists: pgsql-hackers
Attachments
- v3-0001-Add-missing-RestrictSearchPath-calls.patch (text/x-patch) patch v3-0001
- v3-0002-For-materialized-views-use-REFRESH-to-load-data-d.patch (text/x-patch) patch v3-0002
On Fri, 2024-07-12 at 16:11 -0700, Noah Misch wrote: > Since refresh->relation is a RangeVar, this departs from the standard > against > repeated name lookups, from CVE-2014-0062 (commit 5f17304). Interesting, thank you. I did a rough refactor and attached v3. Aside from cleanup issues, is this what you had in mind? Regards, Jeff Davis
Commits
-
doc: Note that CREATE MATERIALIZED VIEW restricts search_path.
- d8ebcac547d7 18.0 landed
- 18cea252ac74 17.1 landed
-
Small refactoring around ExecCreateTableAs().
- 7926a9a80f6d 18.0 landed
-
Add is_create parameter to RefreshMatviewByOid().
- ca2eea3ac89a 18.0 landed
-
Remove unused ParamListInfo argument from ExecRefreshMatView.
- f683d3a4ca6d 18.0 landed
-
When creating materialized views, use REFRESH to load data.
- 4b74ebf726d4 18.0 landed
- b4da732fd64e 17.0 landed
-
Add missing RestrictSearchPath() calls.
- a15b0edb5dd9 17.0 landed
- 8e28778ce396 18.0 landed
-
Fix search_path to a safe value during maintenance operations.
- 2af07e2f749a 17.0 landed
-
Revert MAINTAIN privilege and pg_maintain predefined role.
- 151c22deee66 17.0 cited
-
Avoid repeated name lookups during table and index DDL.
- 5f173040e324 9.4.0 cited
-
Add a materialized view relations.
- 3bf3ab8c5636 9.3.0 cited