[HACKERS] getting confused parsing ACLITEMS...

2003-08-14 Thread Christopher Kings-Lynne
This is the situation, I create a user called " test=# create user ; CREATE USER test=# drop user ; DROP USER test=# create user ; CREATE USER test=# create table temp(a int4); CREATE TABLE test=# grant select on temp to ; GRANT test=# \dp temp Access privileges for

Re: [HACKERS] getting confused parsing ACLITEMS...

2003-08-14 Thread Christopher Kings-Lynne
OK, So if you agree that there is a quoting problem,and you don't mind breaking backwards compatibility for it, I'll do a complete patch... Chris On Fri, 8 Aug 2003, Tom Lane wrote: > "Christopher Kings-Lynne" <[EMAIL PROTECTED]> writes: > > The situation seems to be a bug that this patch would

Re: [HACKERS] getting confused parsing ACLITEMS...

2003-08-14 Thread Andrew Dunstan
I know. It just makes a few things a pain if you can't say "I know this character can't be part of that". Nevermind. Just wishful thinking. I'll shut up now. andrew Christopher Kings-Lynne wrote: Seriously, I think there's a good case for banning a few characters in at least some names - like

Re: [HACKERS] getting confused parsing ACLITEMS...

2003-08-14 Thread Tom Lane
"Christopher Kings-Lynne" <[EMAIL PROTECTED]> writes: > The situation seems to be a bug that this patch would address. It seems to > me that when a username is considered unsafe due to containing double > quotes, the double quotes should be escaped (and the backslashes)! > Does this look alright?

Re: [HACKERS] getting confused parsing ACLITEMS...

2003-08-14 Thread Tom Lane
Andreas Pflug <[EMAIL PROTECTED]> writes: > Is it useful to allow these special chars at all? Seems this creates a > lot of work, and most admins will probably stick to "normal" user names > anyway. Well, the reason it's been left unfixed for so long is exactly that it didn't seem pressing. But

Re: [HACKERS] getting confused parsing ACLITEMS...

2003-08-14 Thread Christopher Kings-Lynne
The situation seems to be a bug that this patch would address. It seems to me that when a username is considered unsafe due to containing double quotes, the double quotes should be escaped (and the backslashes)! Does this look alright? Chris Index: src/backend/utils/adt/acl.c ==

Re: [HACKERS] getting confused parsing ACLITEMS...

2003-08-11 Thread Andrew Dunstan
Of course, now I've just gone to some trouble to accomodate funky characters in user and dbnames in logging I'd have to kill him ... :-) Seriously, I think there's a good case for banning a few characters in at least some names - like []<>'"~#*|\ , say andrew Tom Lane wrote: Andreas Pflug <[

Re: [HACKERS] getting confused parsing ACLITEMS...

2003-08-11 Thread Tom Lane
Christopher Kings-Lynne <[EMAIL PROTECTED]> writes: > So if you agree that there is a quoting problem,and you don't mind > breaking backwards compatibility for it, I'll do a complete patch... I don't see any backwards-compatibility issue, because usernames containing double quotes just plain don't

Re: [HACKERS] getting confused parsing ACLITEMS...

2003-08-10 Thread Tom Lane
Christopher Kings-Lynne <[EMAIL PROTECTED]> writes: >> More to the point, this is highly incomplete... you did not teach the >> adjacent getid routine about this, and there is code in (at least) >> pg_dump.c that knows the quoting conventions used here. > Hang on - those routines can parse the acl

Re: [HACKERS] getting confused parsing ACLITEMS...

2003-08-09 Thread Christopher Kings-Lynne
> Seriously, I think there's a good case for banning a few characters in > at least some names - like []<>'"~#*|\ , say Why? They're allowed in all other identifiers. And what if someone already has a database full of usernames with those chars? They wouldn't be able to load their dump properly

Re: [HACKERS] getting confused parsing ACLITEMS...

2003-08-09 Thread Andreas Pflug
Tom Lane wrote: Christopher Kings-Lynne <[EMAIL PROTECTED]> writes: So if you agree that there is a quoting problem,and you don't mind breaking backwards compatibility for it, I'll do a complete patch... I don't see any backwards-compatibility issue, because usernames containing double quo

Re: [HACKERS] getting confused parsing ACLITEMS...

2003-08-09 Thread Christopher Kings-Lynne
> More to the point, this is highly incomplete... you did not teach the > adjacent getid routine about this, and there is code in (at least) > pg_dump.c that knows the quoting conventions used here. Hang on - those routines can parse the acls just fine? How? How do they handle usernames with equ