postgresql/src/backend
Tom Lane ee87b482c3 Handle RLS dependencies in inlined set-returning functions properly.
If an SRF in the FROM clause references a table having row-level
security policies, and we inline that SRF into the calling query,
we neglected to mark the plan as potentially dependent on which
role is executing it.  This could lead to later executions in the
same session returning or hiding rows that should have been hidden
or returned instead.

Our thanks to Wolfgang Walther for reporting this problem.

Stephen Frost and Tom Lane

Security: CVE-2023-2455
2023-05-08 10:12:45 -04:00
..
access Avoid trying to write an empty WAL record in log_newpage_range(). 2023-04-17 14:22:06 -04:00
bootstrap Revert "Skip WAL for new relfilenodes, under wal_level=minimal." 2020-03-22 09:24:13 -07:00
catalog Replace last PushOverrideSearchPath() call with set_config_option(). 2023-05-08 06:14:12 -07:00
commands Replace last PushOverrideSearchPath() call with set_config_option(). 2023-05-08 06:14:12 -07:00
executor Fix assignment to array of domain over composite, redux. 2023-04-15 12:01:39 -04:00
foreign Update copyright for 2019 2019-01-02 12:44:25 -05:00
jit Fix typos in comments, code and documentation 2023-01-03 16:26:37 +09:00
lib Fix lock assertions in dshash.c. 2022-07-11 15:51:47 +12:00
libpq Fix handling of SCRAM-SHA-256's channel binding with RSA-PSS certificates 2023-02-15 10:12:38 +09:00
main Fix outdated --help message for postgres -f 2022-08-15 13:37:42 +09:00
nodes Further fixes for MULTIEXPR_SUBLINK fix. 2022-09-06 16:38:18 -04:00
optimizer Handle RLS dependencies in inlined set-returning functions properly. 2023-05-08 10:12:45 -04:00
parser Fix crashes with CREATE SCHEMA AUTHORIZATION and schema elements 2023-04-28 19:29:42 +09:00
partitioning Fix incorrect partition pruning logic for boolean partitioned tables 2023-04-14 16:22:46 +12:00
po Translation updates 2023-05-08 14:43:15 +02:00
port Reject huge_pages=on if shared_memory_type=sysv. 2021-10-26 13:01:52 +13:00
postmaster Fix vacuum_cost_delay check for balance calculation. 2023-04-25 13:54:10 +02:00
regex Avoid character classification in regex escape parsing. 2023-04-21 08:21:04 -07:00
replication Don't repeatedly register cache callbacks in pgoutput plugin. 2023-02-23 15:40:28 -05:00
rewrite Fix more bugs caused by adding columns to the end of a view. 2023-03-07 18:21:37 -05:00
snowball In the Snowball dictionary, don't try to stem excessively-long words. 2022-08-31 10:42:05 -04:00
statistics Build inherited extended stats on partitioned tables 2022-01-15 19:02:58 +01:00
storage Fix race in SERIALIZABLE READ ONLY. 2023-03-09 17:25:20 +13:00
tcop Rethink handling of [Prevent|Is]InTransactionBlock in pipeline mode. 2022-12-13 14:23:59 -05:00
tsearch Fix ts_headline() edge cases for empty query and empty search text. 2023-04-06 15:52:37 -04:00
utils In array_position()/array_positions(), beware of empty input array. 2023-05-04 11:48:23 -04:00
.gitignore Add .gitignore entries for AIX-specific intermediate build artifacts. 2015-07-08 20:44:22 -04:00
Makefile Get rid of jsonpath_gram.h and jsonpath_scanner.h 2019-03-20 11:13:34 +03:00
common.mk Remove PARTIAL_LINKING build mode. 2018-03-30 17:33:04 -07:00
nls.mk Translation updates 2020-08-10 15:21:18 +02:00