1. 28 May, 2006 5 commits
  2. 27 May, 2006 5 commits
  3. 26 May, 2006 7 commits
  4. 25 May, 2006 1 commit
  5. 24 May, 2006 3 commits
  6. 23 May, 2006 11 commits
  7. 22 May, 2006 4 commits
  8. 21 May, 2006 4 commits
    • Tom Lane's avatar
      Update release notes for upcoming releases. · e9cc5302
      Tom Lane authored
      e9cc5302
    • Bruce Momjian's avatar
      c6aa53e8
    • Tom Lane's avatar
      Fix errors in fortuna PRNG reseeding logic that could cause a predictable · 5cf07901
      Tom Lane authored
      session key to be selected by pgp_sym_encrypt() in some cases.  This only
      affects non-OpenSSL-using builds.  Marko Kreen
      5cf07901
    • Tom Lane's avatar
      Modify libpq's string-escaping routines to be aware of encoding considerations · 515112f9
      Tom Lane authored
      and standard_conforming_strings.  The encoding changes are needed for proper
      escaping in multibyte encodings, as per the SQL-injection vulnerabilities
      noted in CVE-2006-2313 and CVE-2006-2314.  Concurrent fixes are being applied
      to the server to ensure that it rejects queries that may have been corrupted
      by attempted SQL injection, but this merely guarantees that unpatched clients
      will fail rather than allow injection.  An actual fix requires changing the
      client-side code.  While at it we have also fixed these routines to understand
      about standard_conforming_strings, so that the upcoming changeover to SQL-spec
      string syntax can be somewhat transparent to client code.
      
      Since the existing API of PQescapeString and PQescapeBytea provides no way to
      inform them which settings are in use, these functions are now deprecated in
      favor of new functions PQescapeStringConn and PQescapeByteaConn.  The new
      functions take the PGconn to which the string will be sent as an additional
      parameter, and look inside the connection structure to determine what to do.
      So as to provide some functionality for clients using the old functions,
      libpq stores the latest encoding and standard_conforming_strings values
      received from the backend in static variables, and the old functions consult
      these variables.  This will work reliably in clients using only one Postgres
      connection at a time, or even multiple connections if they all use the same
      encoding and string syntax settings; which should cover many practical
      scenarios.
      
      Clients that use homebrew escaping methods, such as PHP's addslashes()
      function or even hardwired regexp substitution, will require extra effort
      to fix :-(.  It is strongly recommended that such code be replaced by use of
      PQescapeStringConn/PQescapeByteaConn if at all feasible.
      515112f9