Re: [GENERAL] PostgreSQL + Hibernate, Apache Mod Security, SQL Injection and you (a love story)

2010-02-08 Thread David Kerr
On Fri, Feb 05, 2010 at 09:19:40PM +0100, Sebastian Hennebrueder wrote: - John R Pierce schrieb: - >David Kerr wrote: - >>Howdy all, - >> - >>We're using Postgres 8.3 with all of our apps connecting to the database - >>with Hibernate / JPA. - >> - >>Our security team is concerned about SQL Injectio

Re: [GENERAL] PostgreSQL + Hibernate, Apache Mod Security, SQL Injection and you (a love story)

2010-02-08 Thread David Kerr
On Fri, Feb 05, 2010 at 12:09:57PM -0800, John R Pierce wrote: - that would be a function of how you use Postgresql. if you do the - typical PHP hacker style of building statements with inline values then - executing them, you're vunerable unless you totally sanitize all your - inputs. see

Re: [GENERAL] PostgreSQL + Hibernate, Apache Mod Security, SQL Injection and you (a love story)

2010-02-05 Thread Scott Marlowe
On Fri, Feb 5, 2010 at 1:09 PM, John R Pierce wrote: > if you use parameterized calls (easy in perl, java, etc but not so easy in > php), you're should be immune.  in the past there were some issues with > specific evil mis-coded UTF8 sequences, but afaik, thats been cleared up for > quite a while

Re: [GENERAL] PostgreSQL + Hibernate, Apache Mod Security, SQL Injection and you (a love story)

2010-02-05 Thread Sebastian Hennebrueder
John R Pierce schrieb: David Kerr wrote: Howdy all, We're using Postgres 8.3 with all of our apps connecting to the database with Hibernate / JPA. Our security team is concerned about SQL Injection attacks, and would like to implement some mod_security rules to protect against it. From what

Re: [GENERAL] PostgreSQL + Hibernate, Apache Mod Security, SQL Injection and you (a love story)

2010-02-05 Thread John R Pierce
David Kerr wrote: Howdy all, We're using Postgres 8.3 with all of our apps connecting to the database with Hibernate / JPA. Our security team is concerned about SQL Injection attacks, and would like to implement some mod_security rules to protect against it. From what I've read Postgres vani

[GENERAL] PostgreSQL + Hibernate, Apache Mod Security, SQL Injection and you (a love story)

2010-02-05 Thread David Kerr
Howdy all, We're using Postgres 8.3 with all of our apps connecting to the database with Hibernate / JPA. Our security team is concerned about SQL Injection attacks, and would like to implement some mod_security rules to protect against it. From what I've read Postgres vanilla is pretty robus

Re: [GENERAL] PostgreSQL Hibernate Problem

2009-04-28 Thread mgazzo
This solved it. Just renamed my tables with lowercase letters. Thanks a lot.:clap: BTW Hibernate forum is currently in maintenance mode and I just tried my luck here. Sorry about that. Cheers Mario dmigowski wrote: > > Hello mgazzo, > > mgazzo schrieb: >> I am new to PostgreSQL and I want to

Re: [GENERAL] PostgreSQL Hibernate Problem

2009-04-28 Thread Daniel Migowski
Hello mgazzo, mgazzo schrieb: I am new to PostgreSQL and I want to use it from a Java Application with the Hibernate ORM. I ran into a problem when I created my first simple Hello Postegres app where I receive a 'relation "X" does not exist' error. It turns out that the query Hibernate produces

[GENERAL] PostgreSQL Hibernate Problem

2009-04-27 Thread mgazzo
I am new to PostgreSQL and I want to use it from a Java Application with the Hibernate ORM. I ran into a problem when I created my first simple Hello Postegres app where I receive a 'relation "X" does not exist' error. It turns out that the query Hibernate produces seems to be missing some quotes

Re: [GENERAL] PostgreSQL + hibernate

2006-01-31 Thread Myatluk Andrey
[mailto:[EMAIL PROTECTED] Sent: Tuesday, January 31, 2006 10:26 AM To: Myatluk Andrey Cc: pgsql-general@postgresql.org Subject: Re: [GENERAL] PostgreSQL + hibernate Hi, Are you doing this as the same user that your application uses? Maybe the application postgresql user doesn't have access t

Re: [GENERAL] PostgreSQL + hibernate

2006-01-31 Thread Jim C. Nasby
On Tue, Jan 31, 2006 at 10:13:05AM +0300, Myatluk Andrey wrote: > SEVERE: ERROR: current transaction is aborted, commands ignored until > end of transaction block Jan 30, 2006 8:21:35 PM That error means something prior to that in the same transaction failed and you haven't issued a rollback yet.

Re: [GENERAL] PostgreSQL + hibernate

2006-01-31 Thread Doug McNaught
"Myatluk Andrey" <[EMAIL PROTECTED]> writes: > Hi, Chris! > > I've set the sequence owner to my database user. It hasn't changed > anything. > > I guess I have to connect through psql as user and then see what > happens. > If it fails, what could be my next step? That would depend on the error me

Re: [GENERAL] PostgreSQL + hibernate

2006-01-31 Thread Csaba Nagy
ervice(HttpServlet.java:802) > > note The full stack trace of the root cause is available in the Apache > Tomcat/5.5.12 logs. > Apache Tomcat/5.5.12 > > -Original Message- > From: Csaba Nagy [mailto:[EMAIL PROTECTED] > Sent: Tuesday, January 31, 2006 12:44 PM > To:

Re: [GENERAL] PostgreSQL + hibernate

2006-01-31 Thread Myatluk Andrey
t: Tuesday, January 31, 2006 10:26 AM To: Myatluk Andrey Cc: pgsql-general@postgresql.org Subject: Re: [GENERAL] PostgreSQL + hibernate Hi, Are you doing this as the same user that your application uses? Maybe the application postgresql user doesn't have access to the sequence but the defa

Re: [GENERAL] PostgreSQL + hibernate

2006-01-31 Thread Myatluk Andrey
lable in the Apache Tomcat/5.5.12 logs. Apache Tomcat/5.5.12 -Original Message- From: Csaba Nagy [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 31, 2006 12:44 PM To: Myatluk Andrey Cc: Postgres general mailing list Subject: Re: [GENERAL] PostgreSQL + hibernate The error you're se

Re: [GENERAL] PostgreSQL + hibernate

2006-01-31 Thread Csaba Nagy
The error you're seeing comes from before. You only see the fact that there was an error, and postgres is ignoring your queries until you roll back. I bet you have a glitch in your transaction handling code, like opening a transaction, getting an error on it, hibernate throws an error and you don't

Re: [GENERAL] PostgreSQL + hibernate

2006-01-30 Thread Chris
Hi, Are you doing this as the same user that your application uses? Maybe the application postgresql user doesn't have access to the sequence but the default user you're connecting as does. ( You're connecting as a postgresql super-user because you have a '#' in your command prompt - a regul

[GENERAL] PostgreSQL + hibernate

2006-01-30 Thread Myatluk Andrey
Hi! I have an application, consisting of Struts 1.2 + Tomcat 5.5 + Hibernate 3.1 + PostgreSQL 8.1 The application is developed on WinXP and installed on Fedora Core 4. On local machine everything works OK. Both databases are created from the same script and application is the same. But when ins