dbTalk Databases Forums  

[BUGS] BUG #1834: Non-super-user must be able to copy from a file through JDBC

mailing.database.pgsql-bugs mailing.database.pgsql-bugs


Discuss [BUGS] BUG #1834: Non-super-user must be able to copy from a file through JDBC in the mailing.database.pgsql-bugs forum.



Reply
 
Thread Tools Display Modes
  #1  
Old   
Bernard
 
Posts: n/a

Default [BUGS] BUG #1834: Non-super-user must be able to copy from a file through JDBC - 08-18-2005 , 06:03 PM







The following bug has been logged online:

Bug reference: 1834
Logged by: Bernard
Email address: bht (AT) actrix (DOT) gen.nz
PostgreSQL version: 8.03
Operating system: Linux RedHat 9
Description: Non-super-user must be able to copy from a file through
JDBC
Details:

On the attempt to bulk load a table from a file that is owned by the
non-superuser current database user, the following error message is
printed:

"must be superuser to COPY to or from a file"

Following this advice would force the application to connect as superuser
which is a severe security risk.

The postgres-specific workaround to use STDIN with COPY is not supported by
the Postgres JDBC driver.

In comparison MySQL bulk loading works for all users with its JDBC driver.

We need a Postgresql solution to this security issue that is as simple as
the MySQL version.

We have a web application where both MySQL and Postresql are supported. With
Postgresql, the application would have to connect as user postgres. We have
to explain this security risk to our clients very clearly.

---------------------------(end of broadcast)---------------------------
TIP 2: Don't 'kill -9' the postmaster

Reply With Quote
Reply




Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Powered by vBulletin Version 3.5.3
Copyright ©2000 - 2012, Jelsoft Enterprises Ltd.