Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitde323d5

Browse files
committed
Require execute permission on the trigger function for CREATE TRIGGER.
This check was overlooked when we added function execute permissions to thesystem years ago. For an ordinary trigger function it's not a big deal,since trigger functions execute with the permissions of the table owner,so they couldn't do anything the user issuing the CREATE TRIGGER couldn'thave done anyway. However, if a trigger function is SECURITY DEFINER,that is not the case. The lack of checking would allow another user toinstall it on his own table and then invoke it with, essentially, forgedinput data; which the trigger function is unlikely to realize, so it mightdo something undesirable, for instance insert false entries in an audit logtable.Reported by Dinesh Kumar, patch by Robert HaasSecurity:CVE-2012-0866
1 parent144fcf7 commitde323d5

File tree

2 files changed

+11
-3
lines changed

2 files changed

+11
-3
lines changed

‎doc/src/sgml/ref/create_trigger.sgml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,8 @@ UPDATE OF <replaceable>column_name1</replaceable> [, <replaceable>column_name2</
229229

230230
<para>
231231
To create a trigger on a table, the user must have the
232-
<literal>TRIGGER</literal> privilege on the table.
232+
<literal>TRIGGER</literal> privilege on the table. The user must
233+
also have <literal>EXECUTE</literal> privilege on the trigger function.
233234
</para>
234235

235236
<para>

‎src/backend/commands/trigger.c

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -104,8 +104,8 @@ static void AfterTriggerSaveEvent(EState *estate, ResultRelInfo *relinfo,
104104
* if TRUE causes us to modify the given trigger name to ensure uniqueness.
105105
*
106106
* When isInternal is not true we require ACL_TRIGGER permissions on the
107-
* relation. For internal triggersthecaller must apply any required
108-
* permission checks.
107+
* relation, as well as ACL_EXECUTE onthetrigger function. For internal
108+
*triggers the caller must apply any requiredpermission checks.
109109
*
110110
* Note: can return InvalidOid if we decided to not create a trigger at all,
111111
* but a foreign-key constraint. This is a kluge for backwards compatibility.
@@ -309,6 +309,13 @@ CreateTrigger(CreateTrigStmt *stmt, const char *queryString,
309309
* Find and validate the trigger function.
310310
*/
311311
funcoid=LookupFuncName(stmt->funcname,0,fargtypes, false);
312+
if (!isInternal)
313+
{
314+
aclresult=pg_proc_aclcheck(funcoid,GetUserId(),ACL_EXECUTE);
315+
if (aclresult!=ACLCHECK_OK)
316+
aclcheck_error(aclresult,ACL_KIND_PROC,
317+
NameListToString(stmt->funcname));
318+
}
312319
funcrettype=get_func_rettype(funcoid);
313320
if (funcrettype!=TRIGGEROID)
314321
{

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp