Bruce Momjian <[EMAIL PROTECTED]> writes:
> Tom Lane wrote:
>> I'm pretty much against allowing configuration editing from remote
>> altogether.

> Why can't they just use COPY to replace the contents of pg_hba.conf now?

If you've write-protected it, that doesn't work.

Also, COPY insists on an absolute path, and if the attacker doesn't know
the value of $PGDATA or $HOME then he'll have some difficulty doing
anything much with it.  I thought that the handy default of $PGDATA in
the proposed functions was pretty unwise all by itself --- if they don't
require absolute paths then that's still another new door we'll be opening.

                        regards, tom lane

---------------------------(end of broadcast)---------------------------
TIP 1: subscribe and unsubscribe commands go to [EMAIL PROTECTED]

Reply via email to