Lock down regression testing temporary clusters on Windows. Use SSPI authentication to allow connections exclusively from the OS user that launched the test suite. This closes on Windows the vulnerability that commit be76a6d39e2832d4b88c0e1cc381aa44a7f86881 closed on other platforms. Users of "make installcheck" or custom test harnesses can run "pg_regress --config-auth=DATADIR" to activate the same authentication configuration that "make check" would use. Back-patch to 9.0 (all supported versions).
Security: CVE-2014-0067 Branch ------ master Details ------- http://git.postgresql.org/pg/commitdiff/f6dc6dd5ba54d52c0733aaafc50da2fbaeabb8b0 Modified Files -------------- contrib/pg_upgrade/test.sh | 15 +++- doc/src/sgml/regress.sgml | 13 --- src/Makefile.global.in | 2 +- src/bin/pg_ctl/t/001_start_stop.pl | 6 +- src/bin/pg_ctl/t/002_status.pl | 2 +- src/test/perl/TestLib.pm | 11 ++- src/test/regress/pg_regress.c | 171 ++++++++++++++++++++++++++++++++++++ src/tools/msvc/vcregress.pl | 14 ++- 8 files changed, 211 insertions(+), 23 deletions(-) -- Sent via pgsql-committers mailing list ([email protected]) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-committers
