postgresql/contrib
Jeff Davis 05e1737351 Fix search_path to a safe value during maintenance operations.
While executing maintenance operations (ANALYZE, CLUSTER, REFRESH
MATERIALIZED VIEW, REINDEX, or VACUUM), set search_path to
'pg_catalog, pg_temp' to prevent inconsistent behavior.

Functions that are used for functional indexes, in index expressions,
or in materialized views and depend on a different search path must be
declared with CREATE FUNCTION ... SET search_path='...'.

This change addresses a security risk introduced in commit 60684dd834,
where a role with MAINTAIN privileges on a table may be able to
escalate privileges to the table owner. That commit is not yet part of
any release, so no need to backpatch.

Discussion: https://postgr.es/m/e44327179e5c9015c8dda67351c04da552066017.camel%40j-davis.com
Reviewed-by: Greg Stark
Reviewed-by: Nathan Bossart
2023-06-09 11:20:47 -07:00
..
adminpack Use "data directory" not "current directory" in error messages. 2023-03-16 12:04:08 -04:00
amcheck Fix search_path to a safe value during maintenance operations. 2023-06-09 11:20:47 -07:00
auth_delay Fix copy-pasto in contrib/auth_delay/meson.build variable name. 2023-04-02 09:31:10 -07:00
auto_explain Pre-beta mechanical code beautification. 2023-05-19 17:24:48 -04:00
basebackup_to_shell Pre-beta mechanical code beautification. 2023-05-19 17:24:48 -04:00
basic_archive Pre-beta mechanical code beautification. 2023-05-19 17:24:48 -04:00
bloom Introduce PG_IO_ALIGN_SIZE and align all I/O buffers. 2023-04-08 16:34:50 +12:00
bool_plperl
btree_gin
btree_gist Remove useless casts to (void *) in arguments of some system functions 2023-02-07 06:57:59 +01:00
citext Remove read-only server settings lc_collate and lc_ctype 2023-06-07 16:57:06 +02:00
cube Rework pg_input_error_message(), now renamed pg_input_error_info() 2023-02-28 08:04:13 +09:00
dblink rename "gss_accept_deleg" to "gss_accept_delegation". 2023-05-20 21:32:54 -04:00
dict_int
dict_xsyn
earthdistance
file_fdw Improve several permission-related error messages. 2023-03-17 10:33:09 +01:00
fuzzystrmatch Ensure Soundex difference() function handles empty input sanely. 2023-05-16 10:53:42 -04:00
hstore Rework pg_input_error_message(), now renamed pg_input_error_info() 2023-02-28 08:04:13 +09:00
hstore_plperl
hstore_plpython In hstore_plpython, avoid crashing when return value isn't a mapping. 2023-04-27 11:55:06 -04:00
intagg
intarray Pre-beta mechanical code beautification. 2023-05-19 17:24:48 -04:00
isn Rework pg_input_error_message(), now renamed pg_input_error_info() 2023-02-28 08:04:13 +09:00
jsonb_plperl
jsonb_plpython
lo
ltree Pre-beta mechanical code beautification. 2023-05-19 17:24:48 -04:00
ltree_plpython
oid2name Mark options as deprecated in usage output 2023-03-02 14:36:37 +01:00
old_snapshot
pageinspect pageinspect: Fix gist_page_items() with included columns 2023-05-19 12:37:58 +09:00
passwordcheck
pg_buffercache Add pg_buffercache_usage_counts() to contrib/pg_buffercache. 2023-04-07 14:25:53 -04:00
pg_freespacemap
pg_prewarm Pre-beta mechanical code beautification. 2023-05-19 17:24:48 -04:00
pg_stat_statements Fix row tracking in pg_stat_statements with extended query protocol 2023-04-06 09:29:03 +09:00
pg_surgery Remove useless casts to (void *) in arguments of some system functions 2023-02-07 06:57:59 +01:00
pg_trgm Update contrib/trgm_regexp's memory management. 2023-04-08 22:09:17 +12:00
pg_visibility
pg_walinspect Pre-beta mechanical code beautification. 2023-05-19 17:24:48 -04:00
pgcrypto Fix small overestimation of base64 encoding output length. 2023-06-08 11:24:31 -04:00
pgrowlocks
pgstattuple
postgres_fdw Fix filtering of "cloned" outer-join quals some more. 2023-05-25 10:28:33 -04:00
seg Pre-beta mechanical code beautification. 2023-05-19 17:24:48 -04:00
sepgsql Adjust sepgsql expected output for 681d9e462 et al. 2023-05-08 11:24:47 -04:00
spi
sslinfo
start-scripts Remove gratuitous references to postmaster program 2023-01-26 10:48:32 +01:00
tablefunc
tcn
test_decoding Pre-beta mechanical code beautification. 2023-05-19 17:24:48 -04:00
tsm_system_rows
tsm_system_time
unaccent Fix t_isspace(), etc., when datlocprovider=i and datctype=C. 2023-03-17 12:08:46 -07:00
uuid-ossp New header varatt.h split off from postgres.h 2023-01-10 05:54:36 +01:00
vacuumlo
xml2
contrib-global.mk
Makefile Revert "Rename contrib module basic_archive to basic_wal_module" 2023-01-26 09:13:39 +09:00
meson.build Revert "Rename contrib module basic_archive to basic_wal_module" 2023-01-26 09:13:39 +09:00
README

The PostgreSQL contrib tree
---------------------------

This subtree contains porting tools, analysis utilities, and plug-in
features that are not part of the core PostgreSQL system, mainly
because they address a limited audience or are too experimental to be
part of the main source tree.  This does not preclude their
usefulness.

User documentation for each module appears in the main SGML
documentation.

When building from the source distribution, these modules are not
built automatically, unless you build the "world" target.  You can
also build and install them all by running "make all" and "make
install" in this directory; or to build and install just one selected
module, do the same in that module's subdirectory.

Some directories supply new user-defined functions, operators, or
types.  To make use of one of these modules, after you have installed
the code you need to register the new SQL objects in the database
system by executing a CREATE EXTENSION command.  In a fresh database,
you can simply do

    CREATE EXTENSION module_name;

See the PostgreSQL documentation for more information about this
procedure.