diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2013-04-01 13:09:24 -0400 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2013-04-01 13:09:24 -0400 |
| commit | ce9ab88981495d975aade8fc664f99f68fc18e2b (patch) | |
| tree | 9d484b80504beb9d97036a17767c0a21e4dadaa0 /src/backend/access/transam/xlog.c | |
| parent | 85079078acb4f120335f54f38f93635dd8c8b83d (diff) | |
| download | postgresql-ce9ab88981495d975aade8fc664f99f68fc18e2b.tar.gz postgresql-ce9ab88981495d975aade8fc664f99f68fc18e2b.zip | |
Make REPLICATION privilege checks test current user not authenticated user.
The pg_start_backup() and pg_stop_backup() functions checked the privileges
of the initially-authenticated user rather than the current user, which is
wrong. For example, a user-defined index function could successfully call
these functions when executed by ANALYZE within autovacuum. This could
allow an attacker with valid but low-privilege database access to interfere
with creation of routine backups. Reported and fixed by Noah Misch.
Security: CVE-2013-1901
Diffstat (limited to 'src/backend/access/transam/xlog.c')
| -rw-r--r-- | src/backend/access/transam/xlog.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/backend/access/transam/xlog.c b/src/backend/access/transam/xlog.c index 07c68adf0bc..3227d4c6006 100644 --- a/src/backend/access/transam/xlog.c +++ b/src/backend/access/transam/xlog.c @@ -8367,7 +8367,7 @@ do_pg_start_backup(const char *backupidstr, bool fast, TimeLineID *starttli_p, backup_started_in_recovery = RecoveryInProgress(); - if (!superuser() && !is_authenticated_user_replication_role()) + if (!superuser() && !has_rolreplication(GetUserId())) ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), errmsg("must be superuser or replication role to run a backup"))); @@ -8705,7 +8705,7 @@ do_pg_stop_backup(char *labelfile, bool waitforarchive, TimeLineID *stoptli_p) backup_started_in_recovery = RecoveryInProgress(); - if (!superuser() && !is_authenticated_user_replication_role()) + if (!superuser() && !has_rolreplication(GetUserId())) ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), (errmsg("must be superuser or replication role to run a backup")))); |