Correctifs appliqués

Tom Lane pushed:

Noah Misch pushed:

  • Add a temp-install prerequisite to "check"-like targets not having one. Makefile.global assigns this prerequisite to every target named "check", but similar targets must mention it explicitly. Affected targets failed, tested $PATH binaries, or tested a stale temporary installation. The src/test/modules examples worked properly when called as "make -C src/test/modules/$FOO check", but "make -j" allowed the test to start before the temporary installation was in place. Back-patch to 9.5, where commit dcae5faccab64776376d354decda0017c648bb53 introduced the shared temp-install. https://git.postgresql.org/pg/commitdiff/c66b438db62748000700c9b90b585e756dd54141
  • start-scripts: switch to $PGUSER before opening $PGLOG. By default, $PGUSER has permission to unlink $PGLOG. If $PGUSER replaces $PGLOG with a symbolic link, the server will corrupt the link-targeted file by appending log messages. Since these scripts open $PGLOG as root, the attack works regardless of target file ownership. "make install" does not install these scripts anywhere. Users having manually installed them in the past should repeat that process to acquire this fix. Most script users have $PGLOG writable to root only, located in $PGDATA. Just before updating one of these scripts, such users should rename $PGLOG to $PGLOG.old. The script will then recreate $PGLOG with proper ownership. Reviewed by Peter Eisentraut. Reported by Antoine Scemama. Security: CVE-2017-12172 https://git.postgresql.org/pg/commitdiff/dfc015dcf46c1996bd7ed5866e9e045d258604b3
  • Ignore XML declaration in xpath_internal(), for UTF8 databases. When a value contained an XML declaration naming some other encoding, this function interpreted UTF8 bytes as the named encoding, yielding mojibake. xml_parse() already has similar logic. This would be necessary but not sufficient for non-UTF8 databases, so preserve behavior there until the xpath facility can support such databases comprehensively. Back-patch to 9.3 (all supported versions). Pavel Stehule and Noah Misch Discussion: https://postgr.es/m/CAFj8pRC-dM=tT=QkGi+Achkm+gwPmjyOayGuUfXVumCxkDgYWg@mail.gmail.com https://git.postgresql.org/pg/commitdiff/2918fcedbf2b2adab688a7849ecce4556ef912ac
  • Fix previous commit's test, for non-UTF8 databases with non-XML builds. To ensure stable output, catch one more configuration-specific error. Back-patch to 9.3, like the commit that added the test. https://git.postgresql.org/pg/commitdiff/4b865aee2582292a42a8e58247a41b46f5aa8a82
  • Make connect/test1 independent of localhost IPv6. Since commit 868898739a8da9ab74c105b8349b7b5c711f265a, it has assumed "localhost" resolves to both ::1 and 127.0.0.1. We gain nothing from that assumption, and it does not hold in a default installation of Red Hat Enterprise Linux 5. Back-patch to 9.3 (all supported versions). https://git.postgresql.org/pg/commitdiff/34baf8a00b018caf7269134cf9b461266e66d9a7
  • Add post-2010 ecpg tests to checktcp. This suite had been a proper superset of the regular ecpg test suite, but the three newest tests didn't reach it. To make this less likely to recur, delete the extra schedule file and pass the TCP-specific test on the command line. Back-patch to 9.3 (all supported versions). https://git.postgresql.org/pg/commitdiff/0b7e76eb2b142d0b4a2a831e7fa1fac44820f52c

Simon Riggs pushed:

Robert Haas pushed:

Peter Eisentraut pushed:

Dean Rasheed pushed:

  • Always require SELECT permission for ON CONFLICT DO UPDATE. The update path of an INSERT ... ON CONFLICT DO UPDATE requires SELECT permission on the columns of the arbiter index, but it failed to check for that in the case of an arbiter specified by constraint name. In addition, for a table with row level security enabled, it failed to check updated rows against the table's SELECT policies when the update path was taken (regardless of how the arbiter index was specified). Backpatch to 9.5 where ON CONFLICT DO UPDATE and RLS were introduced. Security: CVE-2017-15099 https://git.postgresql.org/pg/commitdiff/87b2ebd352c4afe1ded0841604b59a3afbae97d1

Correctifs en attente

Edmund Horner sent in a patch to add some tab completion to the SELECT target list in psql.

Ashutosh Bapat sent in a patch to improve \d+ output of a partitioned table and separate default partition from rest of the partitions in psql.

Noah Misch sent in a patch to fix a race to build pg_isolation_regress in "make -j check-world".

David Rowley sent in a patch to remove useless DISTINCT clauses.

Thomas Munro sent in a patch atop the statement-level rollback patch to document it better.

Konstantin Knizhnik sent in another revision of a patch to optimize secondary index lookups.

Raúl Marín Rodríguez sent in three more revisions of a patch to add pow() to pgbench.

Asim Praveen sent in two more revisions of a patch to change incorrect calls to PageGetLSN to BufferGetLSNAtomic and assert that locks are properly held in PageGetLSN.

Kyotaro HORIGUCHI and Pavel Stěhule traded patches to add default namespaces for XPath expressions.

Amit Langote and David Rowley traded patches to prune partitions faster.

Haribabu Kommi sent in another revision of a patch to create the infrastructure for pluggable storage.

Nathan Bossart sent in two more revisions of a patch to add new logging for VACUUM and ANALYZE.

Haribabu Kommi sent in another revision of a patch to add a pg_stat_wal_write statistics view.

Haribabu Kommi sent in two more revisions of a patch to refactor handling of database attributes between pg_dump and pg_dumpall.

Tom Lane sent in a patch to speed up compactify_tuples, this time without a sort step.

Alexander Korotkov sent in two more revisions of a patch to fix the bloom WAL tap test.

Thomas Munro sent in a patch to add planning counters to pg_stat_statements.

Michaël Paquier and Fabrízio de Royes Mello traded patches to add session_start and session_end hooks.

Dmitry Dolgov and Artur Zakirov traded patches to add generic subscripting, implementing those for arrays and JSON with same.

Masahiko Sawada sent in a patch to remove a duplicate setting in test/recovery/Makefile.

Kyotaro HORIGUCHI sent in another revision of a patch to restrict the maximum keep segments by repslots.

Amit Khandekar sent in two more revisions of a patch to enable UPDATEs of a partition key to move tuples to the appropriate partition.

Etsuro Fujita sent in a patch to reorder header files in alphabetical order.

Robert Haas sent in another revision of a patch to implement parallel append.

Amit Kapila sent in another revision of a patch to ensure that parallel paths include tlist cost.

Beena Emerson sent in another revision of a patch to implement runtime partiton pruning.

Pavel Stěhule sent in two more revisions of a patch to add \graw to psql.

Michaël Paquier sent in a patch to remove ALLOW_DANGEROUS_LO_FUNCTIONS for LO-related superuser checks, replace superuser checks of large object import/export by ACL checks, and move ACL checks for large objects when opening them.

Huong Dangminh sent in a patch to fix an issue where user-defined data types weren't working right under logical replication.

Mark Rofail sent in another revision of a patch to implement foreign key arrays.

David Rowley sent in a patch to add a mention of CREATE STATISTICS to the event trigger docs.

Robert Haas sent in another revision of a patch to speed up processing at Gather nodes.

Graham Leggett sent in a patch to log SSL certificate verification errors.

Robert Haas and Amit Kapila traded patches to parallelize queries containing initplans.

Pavel Stěhule sent in another revision of a patch to add a SERVER_VERSION variable to psql.

Robert Haas sent in a patch to ensure that GatherMerge pushes tlists down.

Thomas Munro sent in a patch to add a parallel_leader_participation GUC.

Andrey Borodin sent in another revision of a patch to add GiST VACUUM.