1. 07 Aug, 2003 2 commits
    • Barry Lind's avatar
      Sometimes the third time is the charm. Third try to fix the sql injection · acf09c64
      Barry Lind authored
      vulnerability.  This fix completely removes the ability (hack) of being able
      to bind a list of values in an in clause.  It was demonstrated that by allowing
      that functionality you open up the possibility for certain types of
      sql injection attacks.  The previous fix attempts all focused on preventing
      the insertion of additional sql statements (the semi-colon problem:
      xxx; any new sql statement here).  But that still left the ability to
      change the where clause on the current statement or perform a subselect
      which can circumvent applicaiton security logic and/or allow you to call
      any stored function.
      
       Modified Files:
       	jdbc/org/postgresql/jdbc1/AbstractJdbc1Statement.java
      acf09c64
    • Bruce Momjian's avatar
      Update release items from Tom. · f0f13759
      Bruce Momjian authored
      f0f13759
  2. 06 Aug, 2003 10 commits
  3. 05 Aug, 2003 14 commits
  4. 04 Aug, 2003 14 commits