
Recent testing of the BLOB restoration code of pg_dump has highlighted
something that *may* be a problem, but I am not sure. BLOBs create tables,
and AFAICT those tables are owned by the user who was connected at the
time. This theoretically means that even though a user has access to a
table with a BLOB column, they may not be able to read the BLOB - is that
right? Should I worry about this?


----------------------------------------------------------------
Philip Warner                    |     __---_____
Albatross Consulting Pty. Ltd.   |----/       -  \
(A.C.N. 008 659 498)             |          /(@)   ______---_
Tel: (+61) 0500 83 82 81         |                 _________  \
Fax: (+61) 0500 83 82 82         |                 ___________ |
Http://www.rhyme.com.au          |                /           \|
                                 |    --________--
PGP key available upon request,  |  /
and from pgp5.ai.mit.edu:11371   |/

Tue, 01 Aug 2000 23:02:26 +1000
Philip Warner <pjw@rhyme.com.au>
pg_dump & ownership (again)
Philip Warner <pjw@rhyme.com.au> writes:
> Recent testing of the BLOB restoration code of pg_dump has highlighted
> something that *may* be a problem, but I am not sure. BLOBs create tables,
> and AFAICT those tables are owned by the user who was connected at the
> time. This theoretically means that even though a user has access to a
> table with a BLOB column, they may not be able to read the BLOB - is that
> right? Should I worry about this?

The BLOB access code contains no permissions checks --- which is likely
a bug in itself, but anyway if you know the OID of a large object you
can do anything you want to it via the lo_xxx functions.

			regards, tom lane

Tue, 01 Aug 2000 15:49:16 -0400
Tom Lane <tgl@sss.pgh.pa.us>
Re: pg_dump & ownership (again) 
At 15:49 1/08/00 -0400, Tom Lane wrote:
>
>The BLOB access code contains no permissions checks --- which is likely
>a bug in itself, but anyway if you know the OID of a large object you
>can do anything you want to it via the lo_xxx functions.

This is good to know; I really hope that a new BLOB implementation can come
out of TOAST, and get rid of this mess ASAP...


----------------------------------------------------------------
Philip Warner                    |     __---_____
Albatross Consulting Pty. Ltd.   |----/       -  \
(A.C.N. 008 659 498)             |          /(@)   ______---_
Tel: (+61) 0500 83 82 81         |                 _________  \
Fax: (+61) 0500 83 82 82         |                 ___________ |
Http://www.rhyme.com.au          |                /           \|
                                 |    --________--
PGP key available upon request,  |  /
and from pgp5.ai.mit.edu:11371   |/

Wed, 02 Aug 2000 09:12:02 +1000
Philip Warner <pjw@rhyme.com.au>
Re: pg_dump & ownership (again) 