mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-09-29 22:51:57 +02:00
5c31669058
A superuser may create a subscription with password_required=true, but which uses a connection string without a password. Previously, if the owner of such a subscription was changed to a non-superuser, the non-superuser was able to utilize a password from another source (like a password file or the PGPASSWORD environment variable), which should not have been allowed. This commit adds a step to re-validate the connection string before connecting. Reported-by: Jeff Davis Author: Vignesh C Reviewed-by: Peter Smith, Robert Haas, Amit Kapila Discussion: https://www.postgresql.org/message-id/flat/e5892973ae2a80a1a3e0266806640dae3c428100.camel%40j-davis.com Backpatch-through: 16 |
||
---|---|---|
.. | ||
src | ||
KNOWN_BUGS | ||
Makefile | ||
MISSING_FEATURES | ||
TODO |