mirror/postgresql
2
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2024-11-27 07:21:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

Require execute permission on the trigger function for CREATE TRIGGER.

Browse Source 
This check was overlooked when we added function execute permissions to the
system years ago.  For an ordinary trigger function it's not a big deal,
since trigger functions execute with the permissions of the table owner,
so they couldn't do anything the user issuing the CREATE TRIGGER couldn't
have done anyway.  However, if a trigger function is SECURITY DEFINER,
that is not the case.  The lack of checking would allow another user to
install it on his own table and then invoke it with, essentially, forged
input data; which the trigger function is unlikely to realize, so it might
do something undesirable, for instance insert false entries in an audit log
table.

Reported by Dinesh Kumar, patch by Robert Haas

Security: CVE-2012-0866
This commit is contained in:
Tom Lane 2012-02-23 15:39:20 -05:00
parent a930226c61
commit d1b8b8fbea
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
doc/src/sgml/ref/create_trigger.sgml
View File

@ -176,7 +176,8 @@ CREATE TRIGGER <replaceable class="PARAMETER">name</replaceable> { BEFORE | AFTE
<para>
To create a trigger on a table, the user must have the
<literal>TRIGGER</literal> privilege on the table.
<literal>TRIGGER</literal> privilege on the table. The user must
also have <literal>EXECUTE</literal> privilege on the trigger function.
</para>
<para>

4
src/backend/commands/trigger.c
View File

@ -188,6 +188,10 @@ CreateTrigger(CreateTrigStmt *stmt, Oid constraintOid)
* Find and validate the trigger function.
*/
funcoid = LookupFuncName(stmt->funcname, 0, fargtypes, false);
aclresult = pg_proc_aclcheck(funcoid, GetUserId(), ACL_EXECUTE);
if (aclresult != ACLCHECK_OK)
aclcheck_error(aclresult, ACL_KIND_PROC,
NameListToString(stmt->funcname));
funcrettype = get_func_rettype(funcoid);
if (funcrettype != TRIGGEROID)
{