c463338656
After commit 5a2fed911a85ed6d8a015a6bafe3a0d9a69334ae, the catalog state resulting from these commands ceased to affect sessions. Restore the longstanding behavior, which is like beginning the session with a SET ROLE command. If cherry-picking the CVE-2024-10978 fixes, default to including this, too. (This fixes an unintended side effect of fixing CVE-2024-10978.) Back-patch to v12, like that commit. The release team decided to include v12, despite the original intent to halt v12 commits earlier this week. Tom Lane and Noah Misch. Reported by Etienne LAFARGE. Discussion: https://postgr.es/m/CADOZwSb0UsEr4_UTFXC5k7=fyyK8uKXekucd+-uuGjJsGBfxgw@mail.gmail.com
25 lines
1.0 KiB
SQL
25 lines
1.0 KiB
SQL
-- This is borderline unsafe in that an additional login-capable user exists
|
|
-- during the test run. Under installcheck, a too-permissive pg_hba.conf
|
|
-- might allow unwanted logins as regress_authenticated_user_ssa.
|
|
|
|
ALTER USER regress_authenticated_user_ssa superuser;
|
|
CREATE ROLE regress_session_user;
|
|
CREATE ROLE regress_current_user;
|
|
GRANT regress_current_user TO regress_authenticated_user_sr;
|
|
GRANT regress_session_user TO regress_authenticated_user_ssa;
|
|
ALTER ROLE regress_authenticated_user_ssa
|
|
SET session_authorization = regress_session_user;
|
|
ALTER ROLE regress_authenticated_user_sr SET ROLE = regress_current_user;
|
|
|
|
\c - regress_authenticated_user_sr
|
|
SELECT current_user, session_user;
|
|
|
|
-- The longstanding historical behavior is that session_authorization in
|
|
-- setconfig has no effect. Hence, session_user remains
|
|
-- regress_authenticated_user_ssa. See comment in InitializeSessionUserId().
|
|
\c - regress_authenticated_user_ssa
|
|
SELECT current_user, session_user;
|
|
RESET SESSION AUTHORIZATION;
|
|
DROP USER regress_session_user;
|
|
DROP USER regress_current_user;
|