postgresql/src/backend
Tom Lane f8d799eda2 Handle RLS dependencies in inlined set-returning functions properly.
If an SRF in the FROM clause references a table having row-level
security policies, and we inline that SRF into the calling query,
we neglected to mark the plan as potentially dependent on which
role is executing it.  This could lead to later executions in the
same session returning or hiding rows that should have been hidden
or returned instead.

Our thanks to Wolfgang Walther for reporting this problem.

Stephen Frost and Tom Lane

Security: CVE-2023-2455
2023-05-08 10:12:44 -04:00
..
access Prevent underflow in KeepLogSeg(). 2023-04-27 14:32:40 -07:00
bootstrap Rethink definition of pg_attribute.attcompression. 2021-05-27 13:24:27 -04:00
catalog Replace last PushOverrideSearchPath() call with set_config_option(). 2023-05-08 06:14:11 -07:00
commands Replace last PushOverrideSearchPath() call with set_config_option(). 2023-05-08 06:14:11 -07:00
executor Fix buffer refcount leak with FDW bulk inserts 2023-04-25 09:42:36 +09:00
foreign Update copyright for 2021 2021-01-02 13:06:25 -05:00
jit Fix typos in comments, code and documentation 2023-01-03 16:26:30 +09:00
lib Fix lock assertions in dshash.c. 2022-07-11 15:47:12 +12:00
libpq Fix handling of SCRAM-SHA-256's channel binding with RSA-PSS certificates 2023-02-15 10:12:33 +09:00
main Fix outdated --help message for postgres -f 2022-08-15 13:37:38 +09:00
nodes Add missing fields to _outConstraint() 2022-08-13 10:37:45 +02:00
optimizer Handle RLS dependencies in inlined set-returning functions properly. 2023-05-08 10:12:44 -04:00
parser Fix crashes with CREATE SCHEMA AUTHORIZATION and schema elements 2023-04-28 19:29:38 +09:00
partitioning Fix incorrect partition pruning logic for boolean partitioned tables 2023-04-14 16:21:42 +12:00
po Translation updates 2023-05-08 14:33:02 +02:00
port Reject huge_pages=on if shared_memory_type=sysv. 2021-10-26 13:09:00 +13:00
postmaster Fix vacuum_cost_delay check for balance calculation. 2023-04-25 13:54:10 +02:00
regex Avoid character classification in regex escape parsing. 2023-04-21 08:20:32 -07:00
replication Don't repeatedly register cache callbacks in pgoutput plugin. 2023-02-23 15:40:28 -05:00
rewrite Fix more bugs caused by adding columns to the end of a view. 2023-03-07 18:21:37 -05:00
snowball In the Snowball dictionary, don't try to stem excessively-long words. 2022-08-31 10:42:05 -04:00
statistics Remove unnecessary code in dependency_is_compatible_expression(). 2023-03-14 11:10:45 -04:00
storage Fix typo with wait event for SLRU buffer of commit timestamps 2023-05-05 21:25:56 +09:00
tcop Rethink handling of [Prevent|Is]InTransactionBlock in pipeline mode. 2022-12-13 14:23:59 -05:00
tsearch Fix ts_headline() edge cases for empty query and empty search text. 2023-04-06 15:52:37 -04:00
utils In array_position()/array_positions(), beware of empty input array. 2023-05-04 11:48:23 -04:00
.gitignore Add .gitignore entries for AIX-specific intermediate build artifacts. 2015-07-08 20:44:22 -04:00
Makefile Use sort_template.h for qsort_tuple() and qsort_ssup(). 2021-03-03 17:02:32 +13:00
common.mk Remove PARTIAL_LINKING build mode. 2018-03-30 17:33:04 -07:00
nls.mk Translation updates 2021-09-20 16:23:13 +02:00