aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
* Fix some inconsistencies in EXPLAIN outputDavid Rowley2024-05-16
| | | | | | | | | | | | | | | | | | | | | | | 06286709e added a SERIALIZE option to EXPLAIN which included showing the amount of kilobytes serialized. The calculation to convert bytes into kilobytes wasn't consistent with how that's done in the rest of EXPLAIN. Traditionally we round up to the nearest kB, but the new code rounded to the nearest kB. To fix this, invent a macro that does the conversion and use that macro everywhere that requires this conversion. Additionally, 5de890e36 added EXPLAIN (MEMORY) but included the memory sizes in bytes. Convert these values to kilobytes to align with the other memory related outputs. In passing, swap out a "long" type in show_hash_info() and use a uint64 instead. We do support platforms where sizeof(Size) == 8 and sizeof(long) == 4, so using a long there is questionable. Reported-by: jian he Reviewed-by: jian he Discussion: https://www.postgresql.org/message-id/CACJufxE4Sp7xvgOwhqtFx5hS85AxMKobPWDo-xZHZVTpK3EBjA@mail.gmail.com
* Doc: update src/tools/pgindent/README for current practice.Tom Lane2024-05-15
| | | | | | | | | | | This README explains how to run pgindent, but it was written for our former practice of running pgindent only infrequently. Nowadays the plan is to keep the tree indent-clean all the time, so the typical thing is to do an incremental pgindent run with each commit. Revise to explain that as the normal case, and the infrequent full-on process as a separate thing. For now, pgperltidy is still a run-it-infrequently item.
* Fix query result leak during binary upgradeDaniel Gustafsson2024-05-15
| | | | | | | | | | | | 9a974cbcba00 moved the query in binary_upgrade_set_pg_class_oids to the outer level, but left the PQclear and query buffer destruction in the is_index conditional. 353708e1fb2d fixed the leak of the query buffer but left the PGresult leak. This moves clearing the result to the outer level ensuring that it will be called. Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Discussion: https://postgr.es/m/374550C1-F4ED-4D9D-9498-0FD029CCF674@yesql.se Backpatch-through: v15
* Re-forbid underscore in positional parametersPeter Eisentraut2024-05-15
| | | | | | | | | | | | | | | | Underscores were added to numeric literals in faff8f8e47. This change also affected the positional parameters (e.g., $1) rule, which uses the same production for its digits. But this did not actually work, because the digits for parameters are processed using atol(), which does not handle underscores and ignores whatever it cannot parse. The underscores notation is probably not useful for positional parameters, so for simplicity revert that rule to its old form that only accepts digits 0-9. Author: Erik Wienhold <ewie@ewie.name> Reviewed-by: Michael Paquier <michael@paquier.xyz> Discussion: https://www.postgresql.org/message-id/flat/5d216d1c-91f6-4cbe-95e2-b4cbd930520c%40ewie.name
* Remove stray blank line among gram.y keywordsPeter Eisentraut2024-05-15
| | | | introduced by de3600452b
* Make all Perl warnings fatal, catch-upPeter Eisentraut2024-05-15
| | | | Apply c5385929593 to new Perl files that had missed the note.
* Add missing newline at the end of index_including.sqlMichael Paquier2024-05-15
| | | | Thinko in a63224be49b8.
* Fix incorrect year in some copyright notices added this yearDavid Rowley2024-05-15
| | | | | | | A few patches that were written <= 2023 and committed in 2024 still contained 2023 copyright year. Fix that. Discussion: https://postgr.es/m/CAApHDvr5egyW3FmHbAg-Uq2p_Aizwco1Zjs6Vbq18KqN64-hRA@mail.gmail.com
* Fix handling of polymorphic output arguments for procedures.Tom Lane2024-05-14
| | | | | | | | | | | | | | | | | | | | | | | | | Most of the infrastructure for procedure arguments was already okay with polymorphic output arguments, but it turns out that CallStmtResultDesc() was a few bricks shy of a load here. It thought all it needed to do was call build_function_result_tupdesc_t, but that function specifically disclaims responsibility for resolving polymorphic arguments. Failing to handle that doesn't seem to be a problem for CALL in plpgsql, but CALL from plain SQL would get errors like "cannot display a value of type anyelement", or even crash outright. In v14 and later we can simply examine the exposed types of the CallStmt.outargs nodes to get the right type OIDs. But it's a lot more complicated to fix in v12/v13, because those versions don't have CallStmt.outargs, nor do they do expand_function_arguments until ExecuteCallStmt runs. We have to duplicatively run expand_function_arguments, and then re-determine which elements of the args list are output arguments. Per bug #18463 from Drew Kimball. Back-patch to all supported versions, since it's busted in all of them. Discussion: https://postgr.es/m/18463-f8cd77e12564d8a2@postgresql.org
* Do pre-release housekeeping on catalog data.Tom Lane2024-05-14
| | | | | | | Run renumber_oids.pl to move high-numbered OIDs down, as per pre-beta tasks specified by RELEASE_CHANGES. For reference, the command was ./renumber_oids.pl --first-mapped-oid 8000 --target-oid 6300
* Pre-beta mechanical code beautification.Tom Lane2024-05-14
| | | | | | | | | | | | | | Run pgindent, pgperltidy, and reformat-dat-files. The pgindent part of this is pretty small, consisting mainly of fixing up self-inflicted formatting damage from patches that hadn't bothered to add their new typedefs to typedefs.list. In order to keep it from making anything worse, I manually added a dozen or so typedefs that appeared in the existing typedefs.list but not in the buildfarm's list. Perhaps we should formalize that, or better find a way to get those typedefs into the automatic list. pgperltidy is as opinionated as always, and reformat-dat-files too.
* Add missing gettext triggersPeter Eisentraut2024-05-14
| | | | | | | | Commit d6607016c7 moved all the jsonapi.c error messages into token_error(). This needs to be added to the various nls.mk files that use this. Since that makes token_error() effectively a globally known symbol, the name seems a bit too general, so rename to json_token_error() for more clarity.
* Add missing source files to pg_combinebackup/nls.mkPeter Eisentraut2024-05-14
|
* Remove auth-options support from initdbDaniel Gustafsson2024-05-14
| | | | | | | | | | | | | | | | | | | | | | | When --auth was added to initdb in commit e7029b212755 it had support for auth options separated by space from the auth type, like: --auth pam <servicename> --auth ident sameuser Passing an option to the ident auth type was removed in 01c1a12a5bb4 which left the pam auth-options support in place. 8a02339e9ba3 broke this by inverting a calculation in the strncmp arguments, which went unnoticed for a long time. The ability to pass options to the auth type was never documented. Rather than fixing the support for an undocumented feature which has been broken for all supported versions, and which only supports one out of many auth types which can take options, it is removed. Reported-by: Jingxian Li <aqktjcm@qq.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Aleksander Alekseev <aleksander@timescale.com> Discussion: https://postgr.es/m/tencent_29731C7C7E6A2F9FB807C3A1DC3D81293C06@qq.com
* Fix memory leaks in error reporting with LOG levelDaniel Gustafsson2024-05-14
| | | | | | | | | | When loglevel is set to LOG, allocated strings used in the error message would leak. Fix by explicitly pfreeing them. Author: Ranier Vilela <ranier.vf@gmail.com> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Reviewed-by: Michael Paquier <michael@paquier.xyz> Discussion: https://postgr.es/m/CAEudQAqMeE0AHcOsOzZx51Z0eiFJAjhBPRFt+Bxi3ETXWen7ig@mail.gmail.com
* Add missing gettext triggersPeter Eisentraut2024-05-14
| | | | | Due to commit dc212340058, which added use of src/common/parse_manifest.c in the backend.
* Make formatting in nls.mk files more consistentPeter Eisentraut2024-05-14
| | | | | | Some of the nls.mk files used different indentation or line breaks than the majority, which makes editing these files unnecessarily confusing.
* Revert "Temporarily install debugging in partition_prune test"David Rowley2024-05-14
| | | | | | | | | | | | 1db689715 added debugging output to the partition_prune regression test to help us figure out why buildfarm member Parula was occasionally failing. We've not seen any failures in around 4 weeks and the best guess as to what the problem was is a compiler bug. Since there are no recent failures, there's now no need to keep this debugging code, so revert it. Discussion: https://postgr.es/m/CAApHDvqyLF881EvDtXT=ossa0i4ioJBtW2c0Wbouzt5d3HDb5Q@mail.gmail.com
* Fix pg_sequence_last_value() for unlogged sequences on standbys.Nathan Bossart2024-05-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Presently, when this function is called for an unlogged sequence on a standby server, it will error out with a message like ERROR: could not open file "base/5/16388": No such file or directory Since the pg_sequences system view uses pg_sequence_last_value(), it can error similarly. To fix, modify the function to return NULL for unlogged sequences on standby servers. Since this bug is present on all versions since v15, this approach is preferable to making the ERROR nicer because we need to repair the pg_sequences view without modifying its definition on released versions. For consistency, this commit also modifies the function to return NULL for other sessions' temporary sequences. The pg_sequences view already appropriately filters out such sequences, so there's no bug there, but we might as well offer some defense in case someone invokes this function directly. Unlogged sequences were first introduced in v15, but temporary sequences are much older, so while the fix for unlogged sequences is only back-patched to v15, the temporary sequence portion is back-patched to all supported versions. We could also remove the privilege check in the pg_sequences view definition in v18 if we modify this function to return NULL for sequences for which the current user lacks privileges, but that is left as a future exercise for when v18 development begins. Reviewed-by: Tom Lane, Michael Paquier Discussion: https://postgr.es/m/20240501005730.GA594666%40nathanxps13 Backpatch-through: 12
* Remove COMMAND_TAG_NEXTTAG from enum CommandTag.Tom Lane2024-05-13
| | | | | | | | | | | COMMAND_TAG_NEXTTAG isn't really a valid command tag. Declaring it as if it were one prompts complaints from Coverity and perhaps other static analyzers. Our only use of it is in an entirely-unnecessary array sizing declaration, so let's just drop it. Ranier Vilela Discussion: https://postgr.es/m/CAEudQAoY0xrKuTAX7W10zsjjUpKBPFRtdCyScb3Z0FB2v6HNmQ@mail.gmail.com
* Fix regression tests conflict in 3ca43dbbb6Alexander Korotkov2024-05-13
| | | | | | | | | | | | | | | | 3ca43dbbb6 adds regression tests with permission checks. The conflict has been observed at buildfarm member piculet. This commit fixes the conflict in the following way. 1. partition_split.sql now uses role names regress_partition_split_alice and regress_partition_split_bob (it mistakenly used regress_partition_merge_alice and regress_partition_merge_bob before). 2. Permissions on schemas partitions_merge_schema and partition_split_schema are granted to corresponding roles. Before, the lack of permissions led to the creation of objects in the public schema and potential conflict. Reported-by: Daniel Gustafsson Discussion: https://postgr.es/m/03A07EF6-98D2-419B-A3AA-A111C64CC207%40yesql.se
* Revert structural changes to not-null constraintsAlvaro Herrera2024-05-13
| | | | | | | | | | | | | | | | | | | | | | | | | There are some problems with the new way to handle these constraints that were detected at the last minute, and require fixes that appear too invasive to be doing this late in the cycle. Revert this (again) for now, we'll try again with these problems fixed. The following commits are reverted: b0e96f311985 Catalog not-null constraints 9b581c534186 Disallow changing NO INHERIT status of a not-null constraint d0ec2ddbe088 Fix not-null constraint test ac22a9545ca9 Move privilege check to the right place b0f7dd915bca Check stack depth in new recursive functions 3af721794272 Update information_schema definition for not-null constraints c3709100be73 Fix propagating attnotnull in multiple inheritance d9f686a72ee9 Fix restore of not-null constraints with inheritance d72d32f52d26 Don't try to assign smart names to constraints 0cd711271d42 Better handle indirect constraint drops 13daa33fa5a6 Disallow NO INHERIT not-null constraints on partitioned tables d45597f72fe5 Disallow direct change of NO INHERIT of not-null constraints 21ac38f498b3 Fix inconsistencies in error messages Discussion: https://postgr.es/m/202405110940.joxlqcx4dogd@alvherre.pgsql
* Fix test case to do what it intends toAlvaro Herrera2024-05-13
| | | | | | | | | | | | | This test case intended to fail because setting a column as generated to the partitioned table while leaving the partition alone is not allowed; but instead failed because of a discrepancy of not-null constraint. Fix this by adding the not-null constraint first, then set the column as generated in a separate ALTER TABLE command, which gets the expected error. Also, because the next test also wants to set the column as not-null, add a BEGIN/ROLLBACK block so that the added not-null is removed. Oversight in 699586315704.
* Add permission check for MERGE/SPLIT partition operationsAlexander Korotkov2024-05-13
| | | | | | | | | | | | Currently, we check only owner permission for the parent table before MERGE/SPLIT partition operations. This leads to a security hole when users can get access to the data of partitions without permission. This commit fixes this problem by requiring owner permission on all the partitions involved. Reported-by: Alexander Lakhin Discussion: https://postgr.es/m/0520c72e-8d97-245e-53f9-173beca2ab2e%40gmail.com Author: Dmitry Koval, Alexander Korotkov
* injection_points: Store runtime conditions in private areaMichael Paquier2024-05-12
| | | | | | | | | | | | | | | | | | | | | | | This commit fixes a race condition between injection point run and detach, where a point detached by a backend and concurrently running in a second backend could cause the second backend to do an incorrect condition check. This issue happens because the second backend retrieves the callback information in a first step in the shmem hash table for injection points, and the condition in a second step within the callback. If the point is detached between these two steps, the condition would be removed, causing the point to run while it should not. Storing the condition in the new private_data area introduced in 33181b48fd0e ensures that the condition retrieved is consistent with its callback. This commit leads to a lot of simplifications in the module injection_points, as there is no need to handle the runtime conditions inside it anymore. Runtime conditions have no more a maximum number. Per discussion with Noah Misch. Reviewed-by: Noah Misch Discussion: https://postgr.es/m/20240509031553.47@rfd.leadboat.com
* Introduce private data area for injection pointsMichael Paquier2024-05-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit extends the backend-side infrastructure of injection points so as it becomes possible to register some input data when attaching a point. This private data can be registered with the function name and the library name of the callback when attaching a point, then it is given as input argument to the callback. This gives the possibility for modules to pass down custom data at runtime when attaching a point without managing that internally, in a manner consistent with the callback entry retrieved from the hash shmem table storing the injection point data. InjectionPointAttach() gains two arguments, to be able to define the private data contents and its size. A follow-up commit will rely on this infrastructure to close a race condition with the injection point detach in the module injection_points. While on it, this changes InjectionPointDetach() to return a boolean, returning false if a point cannot be detached. This has been mentioned by Noah as useful when it comes to implement more complex tests with concurrent point detach, solid with the automatic detach done for local points in the test module. Documentation is adjusted in consequence. Per discussion with Noah Misch. Reviewed-by: Noah Misch Discussion: https://postgr.es/m/20240509031553.47@rfd.leadboat.com
* Change ALPN protocol ID to IANA-approved "postgresql"Heikki Linnakangas2024-05-11
| | | | | | | | "TBD-pgsql" was a placeholder until the IANA registration was approved. Discussion: https://www.postgresql.org/message-id/87jzk2hj2n.fsf%40wibble.ilmari.org Discussion: https://mailarchive.ietf.org/arch/msg/tls-reg-review/9LWPzQfOpbc8dTT7vc9ahNeNaiw/
* Fix ON CONFLICT DO NOTHING/UPDATE for temporal indexesPeter Eisentraut2024-05-10
| | | | | | | | | | | | | | A PRIMARY KEY or UNIQUE constraint with WITHOUT OVERLAPS will be a GiST index, not a B-Tree, but it will still have indisunique set. The code for ON CONFLICT fails if it sees a non-btree index that has indisunique. This commit fixes that and adds some tests. But now that we can't just test indisunique, we also need some extra checks to prevent DO UPDATE from running against a WITHOUT OVERLAPS constraint (because the conflict could happen against more than one row, and we'd only update one). Author: Paul A. Jungwirth <pj@illuminatedcomputing.com> Discussion: https://www.postgresql.org/message-id/1426589a-83cb-4a89-bf40-713970c07e63@illuminatedcomputing.com
* Fix recursive RECORD-returning plpython functions.Tom Lane2024-05-09
| | | | | | | | | | | | | | | | | | | | If we recursed to a new call of the same function, with a different coldeflist (AS clause), it would fail because the inner call would overwrite the outer call's idea of what to return. This is vaguely like 1d2fe56e4 and c5bec5426, but it's not due to any API decisions: it's just that we computed the actual output rowtype at the start of the call, and saved it in the per-procedure data structure. We can fix it at basically zero cost by doing the computation at the end of each call instead of the start. It's not clear that there's any real-world use-case for such a function, but given that it doesn't cost anything to fix, it'd be silly not to. Per report from Andreas Karlsson. Back-patch to all supported branches. Discussion: https://postgr.es/m/1651a46d-3c15-4028-a8c1-d74937b54e19@proxel.se
* Repair ALTER EXTENSION ... SET SCHEMA.Tom Lane2024-05-09
| | | | | | | | | | | | | | | | | It turns out that we broke this in commit e5bc9454e, because the code was assuming that no dependent types would appear among the extension's direct dependencies, and now they do. This isn't terribly hard to fix: just skip dependent types, expecting that we will recurse to them when we process the parent object (which should also be among the direct dependencies). But a little bit of refactoring is needed so that we can avoid duplicating logic about what is a dependent type. Although there is some testing of ALTER EXTENSION SET SCHEMA, it failed to cover interesting cases, so add more tests. Discussion: https://postgr.es/m/930191.1715205151@sss.pgh.pa.us
* Make left-join removal safe under -DREALLOCATE_BITMAPSETS.Tom Lane2024-05-09
| | | | | | | | | | | | | | | | | | | | | | | | | The initial building of RestrictInfos and SpecialJoinInfos tends to create structures that share relid sets (such as syn_lefthand and outer_relids). There's nothing wrong with that in itself, but when we modify those relid sets during join removal, we have to be sure not to corrupt the values that other structures are pointing at. remove_rel_from_query() was careless about this. It accidentally worked anyway because (1) we'd never be reducing the sets to empty, so they wouldn't get pfree'd; and (2) the in-place modification is the same one that we did or will apply to the other struct's relid set, so that there wasn't visible corruption at the end of the process. While there's no live bug in a standard build, of course this is way too fragile to accept going forward. (Maybe we should back-patch this change too for safety, but I've refrained for now.) This bug was exposed by the recent invention of REALLOCATE_BITMAPSETS. Commit e0477837c had installed a fix, but that went away with the reversion of SJE, so now we need to fix it again. David Rowley and Tom Lane Discussion: https://postgr.es/m/CACJufxFVQmr4=JWHAOSLuKA5Zy9H26nY6tVrRFBOekHoALyCkQ@mail.gmail.com
* psql: Add missing punctuation in help outputPeter Eisentraut2024-05-09
|
* Fix inconsistencies in error messagesAlvaro Herrera2024-05-09
| | | | | | | | | | Reported by Kyotaro Horiguchi Also some comments mentioning wrong version numbers, spotted by Justin Pryzby. Discussion: https://postgr.es/m/20240507.171724.750916195320223609.horikyota.ntt@gmail.com Discussion: https://postgr.es/m/Zh0aAH7tbZb-9HbC@pryzbyj2023
* Fix overread in JSON parsing errors for incomplete byte sequencesMichael Paquier2024-05-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | json_lex_string() relies on pg_encoding_mblen_bounded() to point to the end of a JSON string when generating an error message, and the input it uses is not guaranteed to be null-terminated. It was possible to walk off the end of the input buffer by a few bytes when the last bytes consist of an incomplete multi-byte sequence, as token_terminator would point to a location defined by pg_encoding_mblen_bounded() rather than the end of the input. This commit switches token_terminator so as the error uses data up to the end of the JSON input. More work should be done so as this code could rely on an equivalent of report_invalid_encoding() so as incorrect byte sequences can show in error messages in a readable form. This requires work for at least two cases in the JSON parsing API: an incomplete token and an invalid escape sequence. A more complete solution may be too invasive for a backpatch, so this is left as a future improvement, taking care of the overread first. A test is added on HEAD as test_json_parser makes this issue straight-forward to check. Note that pg_encoding_mblen_bounded() no longer has any callers. This will be removed on HEAD with a separate commit, as this is proving to encourage unsafe coding. Author: Jacob Champion Discussion: https://postgr.es/m/CAOYmi+ncM7pwLS3AnKCSmoqqtpjvA8wmCdoBtKA3ZrB2hZG6zA@mail.gmail.com Backpatch-through: 13
* Add test for REPLICA IDENTITY with a temporal keyPeter Eisentraut2024-05-08
| | | | | | | | | You can only use REPLICA IDENTITY USING INDEX with a unique B-tree index. This commit just adds a test showing that you cannot use it with a WITHOUT OVERLAPS index (which is GiST). Author: Paul A. Jungwirth <pj@illuminatedcomputing.com> Discussion: https://www.postgresql.org/message-id/3775839b-3f0f-4c8a-ac03-a253222e6a4b%40illuminatedcomputing.com
* Fix typo in src/backend/utils/resowner/README.Etsuro Fujita2024-05-08
|
* Fix incorrect format placeholderPeter Eisentraut2024-05-08
|
* Ensure that "pg_restore -l" reports dependent TOC entries correctly.Tom Lane2024-05-07
| | | | | | | | | | | | | | If -l was specified together with selective-restore options such as -n or -N, dependent TOC entries such as comments would be omitted from the listing, even when an actual restore would have selected them. This happened because PrintTOCSummary neglected to update the te->reqs marking of the entry they depended on. Per report from Justin Pryzby. This has been wrong since 0d4e6ed30 taught _tocEntryRequired to sometimes look at the "reqs" marking of other TOC entries, so back-patch to all supported branches. Discussion: https://postgr.es/m/ZjoeirG7yxODdC4P@pryzbyj2023
* Don't corrupt plpython's "TD" dictionary in a recursive trigger call.Tom Lane2024-05-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | If a plpython-language trigger caused another one to be invoked, the "TD" dictionary created for the inner one would overwrite the outer one's "TD" dictionary. This is more or less the same problem that 1d2fe56e4 fixed for ordinary functions in plpython, so fix it the same way, by saving and restoring "TD" during a recursive invocation. This fix makes an ABI-incompatible change in struct PLySavedArgs. I'm not too worried about that because it seems highly unlikely that any extension is messing with those structs. We could imagine doing something weird to preserve nominal ABI compatibility in the back branches, like keeping the saved TD object in an extra element of namedargs[]. However, that would only be very nominal compatibility: if anything *is* touching PLySavedArgs, it would likely do the wrong thing due to not knowing about the additional value. So I judge it not worth the ugliness to do something different there. (I also changed struct PLyProcedure, but its added field fits into formerly-padding space, so that should be safe.) Per bug #18456 from Jacques Combrink. This bug is very ancient, so back-patch to all supported branches. Discussion: https://postgr.es/m/3008982.1714853799@sss.pgh.pa.us
* Fix assorted bugs related to identity column in partitioned tablesPeter Eisentraut2024-05-07
| | | | | | | | | | | | | | | | | When changing the data type of a column of a partitioned table, craft the ALTER SEQUENCE command only once. Partitions do not have identity sequences of their own and thus do not need a ALTER SEQUENCE command for each partition. Fix getIdentitySequence() to fetch the identity sequence associated with the top-level partitioned table when a Relation of a partition is passed to it. While doing so, translate the attribute number of the partition into the attribute number of the partitioned table. Author: Ashutosh Bapat <ashutosh.bapat@enterprisedb.com> Reported-by: Alexander Lakhin <exclusion@gmail.com> Reviewed-by: Dmitry Dolgov <9erthalion6@gmail.com> Discussion: https://www.postgresql.org/message-id/3b8a9dc1-bbc7-0ef5-6863-c432afac7d59@gmail.com
* Remove obsolete comment.Jeff Davis2024-05-07
| | | | | | | | Per suggestion from Peter, the comment was not helpful, so remove it rather than fixing it. Reported-by: Peter Eisentraut Discussion: https://postgr.es/m/d9421b21-e759-4b74-a039-c487b469c1f3@eisentraut.org
* Prevent RLS filters on ctid from breaking WHERE CURRENT OF <cursor>.Tom Lane2024-05-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | The executor only supports CurrentOfExpr as the sole tidqual of a TidScan plan node. tidpath.c failed to take any particular care about that, but would just take the first ctid equality qual it could find in the target relation's baserestrictinfo list. Originally that was fine because the grammar prevents any other WHERE conditions from being combined with CURRENT OF <cursor>. However, if the relation has RLS visibility policies then those would get included in the list. Should such a policy include a condition on ctid, we'd typically grab the wrong qual and produce a malfunctioning plan. To fix, introduce a simplistic priority ordering scheme for which ctid equality qual to prefer. Real-world cases involving more than one such qual are so rare that it doesn't seem worth going to any great trouble to choose one over another, so I didn't work very hard; but this code could be extended in future if someone thinks differently. It's extremely difficult to think of a reasonable use-case for an RLS restriction involving ctid, and certainly we've heard no field reports of this failure. So this doesn't seem worthy of back-patching, but in the name of cleanliness let's fix it going forward. Patch by me, per report from Robert Haas. Discussion: https://postgr.es/m/3914881.1715038270@sss.pgh.pa.us
* postgresql.conf: align variable comments, mostly new onesBruce Momjian2024-05-06
| | | | Backpatch-through: master
* Finish incomplete revert of ec63622c0.Tom Lane2024-05-06
| | | | | | | | | | The code change this made might well be fine to keep, but the comment justifying it by reference to self-join removal isn't. Let's just go back to the status quo ante, pending a more thorough review/redesign of SJE. (I found this by grepping to see if any references to self-join removal remained in the tree.)
* Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs.Nathan Bossart2024-05-06
| | | | | | | | | | | | | | | | | | | | | | | The catalog view pg_stats_ext fails to consider privileges for expression statistics. The catalog view pg_stats_ext_exprs fails to consider privileges and row-level security policies. To fix, restrict the data in these views to table owners or roles that inherit privileges of the table owner. It may be possible to apply less restrictive privilege checks in some cases, but that is left as a future exercise. Furthermore, for pg_stats_ext_exprs, do not return data for tables with row-level security enabled, as is already done for pg_stats_ext. On the back-branches, a fix-CVE-2024-4317.sql script is provided that will install into the "share" directory. This file can be used to apply the fix to existing clusters. Bumps catversion on 'master' branch only. Reported-by: Lukas Fittl Reviewed-by: Noah Misch, Tomas Vondra, Tom Lane Security: CVE-2024-4317 Backpatch-through: 14
* Revert: Remove useless self-joinsAlexander Korotkov2024-05-06
| | | | | | | | | | | | | | | | | This commit reverts d3d55ce5713 and subsequent fixes 2b26a694554, 93c85db3b5b, b44a1708abe, b7f315c9d7d, 8a8ed916f73, b5fb6736ed3, 0a93f803f45, e0477837ce4, a7928a57b9f, 5ef34a8fc38, 30b4955a466, 8c441c08279, 028b15405b4, fe093994db4, 489072ab7a9, and 466979ef031. We are quite late in the release cycle and new bugs continue to appear. Even though we have fixes for all known bugs, there is a risk of throwing many bugs to end users. The plan for self-join elimination would be to do more review and testing, then re-commit in the early v18 cycle. Reported-by: Tom Lane Discussion: https://postgr.es/m/2422119.1714691974%40sss.pgh.pa.us
* Translation updatesPeter Eisentraut2024-05-06
| | | | | Source-Git-URL: https://git.postgresql.org/git/pgtranslation/messages.git Source-Git-Hash: be182cc55e6f72c66215fd9b38851969e3ce5480
* injection_points: Fix incorrect spinlock acquisitionMichael Paquier2024-05-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | Injection points created under injection_points_set_local() are cleaned up by a shmem_exit() callback. The spinlock used by the module would be hold while calling InjectionPointDetach(), which is incorrect as spinlocks should avoid external calls while hold. This commit changes the shmem_exit() callback to detach the points in three steps with the spinlock acquired twice, knowing that the injection points should be around with the conditions related to them: - Scans for the points to detach in a first loop, while holding the spinlock. - Detach them. - Remove the registered conditions. It is still possible for other processes to detach local points concurrently of the callback. I have wanted to restrict the detach, but Noah has mentioned that he has in mind some cases that may require this capability. No tests in the tree based on injection points need that currently. Thinko in f587338dec87. Reported-by: Noah Misch Reviewed-by: Noah Misch Discussion: https://postgr.es/m/20240501231214.40@rfd.leadboat.com
* Silence Coverity complaint about possible null-pointer dereference.Tom Lane2024-05-05
| | | | | | | | | If pg_init_privs were to contain a NULL ACL field, this code would pass old_acl == NULL to merge_acl_with_grant, which would crash. The case shouldn't happen, but it just takes a couple more lines of code to guard against it, so do so. Oversight in 534287403; no back-patch needed.
* Fix comment regarding LibreSSL availabilityDaniel Gustafsson2024-05-05
| | | | | | | SSL_AD_NO_APPLICATION_PROTOCOL is indeed available in LibreSSL, but only in 3.4.3 and later (shipped in OpenBSD 7.0). Discussion: https://postgr.es/m/E1s1g0Z-000jeC-OR@gemulon.postgresql.org
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-31 15:17:12 +0000