mirror/postgresql
2
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2024-12-27 08:39:28 +08:00
Code Issues Packages Projects Releases Wiki Activity
15,683 Commits 37 Branches 638 Tags 396 MiB
C 85.6%
PLpgSQL 5.9%
Perl 4.2%
Yacc 1.2%
Makefile 0.7%
Other 2.3%
acf09c64b0
Go to file
Barry Lind acf09c64b0 Sometimes the third time is the charm. Third try to fix the sql injection 
vulnerability.  This fix completely removes the ability (hack) of being able
to bind a list of values in an in clause.  It was demonstrated that by allowing
that functionality you open up the possibility for certain types of
sql injection attacks.  The previous fix attempts all focused on preventing
the insertion of additional sql statements (the semi-colon problem:
xxx; any new sql statement here).  But that still left the ability to
change the where clause on the current statement or perform a subselect
which can circumvent applicaiton security logic and/or allow you to call
any stored function.

 Modified Files:
 	jdbc/org/postgresql/jdbc1/AbstractJdbc1Statement.java
2003-08-07 04:03:13 +00:00
config Have a go at fixing various outstanding portability issues in code that 2003-07-23 23:30:41 +00:00
contrib OpenFTS vs Tsearch2 comment 2003-08-06 14:53:01 +00:00
doc Applied doc patch for the jdbc docs submitted by Nic Ferrier for functionality 2003-08-06 23:50:19 +00:00
src Sometimes the third time is the charm. Third try to fix the sql injection 2003-08-07 04:03:13 +00:00
aclocal.m4 Remove leftovers from subproject removals. Fixes for Python and Kerberos 2002-09-04 22:54:18 +00:00
configure change tag to 7.4beta1 and update the Copyright to 2003 2003-08-04 22:30:30 +00:00
configure.in change tag to 7.4beta1 and update the Copyright to 2003 2003-08-04 22:30:30 +00:00
COPYRIGHT Fix some copyright notices that weren't updated. Improve copyright tool 2003-08-04 23:59:41 +00:00
GNUmakefile.in can't mix and match .gz and .bz2 in here ... won't build 2003-08-05 04:55:58 +00:00
HISTORY Update release items from Tom. 2003-08-07 03:59:25 +00:00
INSTALL Remove --enable-recode feature, since it's been broken by IPv6 changes, 2003-08-04 04:03:10 +00:00
Makefile
README Improve wording. 2002-11-11 20:03:40 +00:00
register.txt Update URL to point to proper location. 2003-06-02 15:01:03 +00:00

README 

PostgreSQL Database Management System
=====================================
  
This directory contains the source code distribution of the PostgreSQL
database management system.

PostgreSQL is an advanced object-relational database management system
that supports an extended subset of the SQL standard, including
transactions, foreign keys, subqueries, triggers, user-defined types
and functions.  This distribution also contains several language
bindings, including C, Perl, Python, and Tcl, as well as a JDBC
driver.

The ODBC and C++ interfaces have been moved to the PostgreSQL Projects
Web Site at http://gborg.postgresql.org for separate maintenance.

See the file INSTALL for instructions on how to build and install
PostgreSQL.  That file also lists supported operating systems and
hardware platforms and contains information regarding any other
software packages that are required to build or run the PostgreSQL
system.  Changes between all PostgreSQL releases are recorded in the
file HISTORY.  Copyright and license information can be found in the
file COPYRIGHT.  A comprehensive documentation set is included in this
distribution; it can be read as described in the installation
instructions.

The latest version of this software may be obtained at
ftp://ftp.postgresql.org/pub/.  For more information look at our web
site located at http://www.postgresql.org/.