diff options
| author | Nathan Bossart <nathan@postgresql.org> | 2023-07-13 21:13:45 -0700 |
|---|---|---|
| committer | Nathan Bossart <nathan@postgresql.org> | 2023-07-13 21:13:45 -0700 |
| commit | a0363ab7aafda7d16ae59e72d86866c02ad3d657 (patch) | |
| tree | b682bf6ca6b4a56e17f03a4f5b9f12fcb4f9b86a /doc/src | |
| parent | 9987a7bf34061ed5cffc4e5113da056358976e94 (diff) | |
| download | postgresql-a0363ab7aafda7d16ae59e72d86866c02ad3d657.tar.gz postgresql-a0363ab7aafda7d16ae59e72d86866c02ad3d657.zip | |
Fix privilege check for SET SESSION AUTHORIZATION.
Presently, the privilege check for SET SESSION AUTHORIZATION checks
whether the original authenticated role was a superuser at
connection start time. Even if the role loses the superuser
attribute, its existing sessions are permitted to change session
authorization to any role.
This commit modifies this privilege check to verify the original
authenticated role currently has superuser. In the event that the
authenticated role loses superuser within a session authorization
change, the authorization change will remain in effect, which means
the user can still take advantage of the target role's privileges.
However, [RE]SET SESSION AUTHORIZATION will only permit switching
to the original authenticated role.
Author: Joseph Koshakow
Discussion: https://postgr.es/m/CAAvxfHc-HHzONQ2oXdvhFF9ayRnidPwK%2BfVBhRzaBWYYLVQL-g%40mail.gmail.com
Diffstat (limited to 'doc/src')
| -rw-r--r-- | doc/src/sgml/ref/set_session_auth.sgml | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/doc/src/sgml/ref/set_session_auth.sgml b/doc/src/sgml/ref/set_session_auth.sgml index f8fcafc1946..94adab2468d 100644 --- a/doc/src/sgml/ref/set_session_auth.sgml +++ b/doc/src/sgml/ref/set_session_auth.sgml @@ -51,7 +51,7 @@ RESET SESSION AUTHORIZATION <para> The session user identifier can be changed only if the initial session - user (the <firstterm>authenticated user</firstterm>) had the + user (the <firstterm>authenticated user</firstterm>) has the superuser privilege. Otherwise, the command is accepted only if it specifies the authenticated user name. </para> |