Re: BUG #14600: Passwords in user mappings leaked by psql \deu+ command

Feike Steenbergen <feikesteenbergen@gmail.com>

From: Feike Steenbergen <feikesteenbergen@gmail.com>

To: andrew.wheelwright@familysearch.org

Cc: PostgreSQL mailing lists <pgsql-bugs@postgresql.org>

Date: 2017-03-29T17:53:50Z

Lists: pgsql-bugs

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

Revise the permission checking on user mapping DDL commands.
- 93a6be63a55a 8.4.0 cited

Attachments

user_mappings_leak.patch (application/octet-stream) patch

Attached a patch which copies the logic from commit
93a6be63a55a8cd0d73b3fa81eb6a46013a3a974.

In the current implementation we only consider privileges of the foreign
server
in determining whether or not to show the user mapping details. This patch
copies the same logic (and documentation) used in commit
93a6be63a55a8cd0d73b3fa81eb6a46013a3a974 to not always show the user mapping
options.

regards,

Feike