Is this the regular behavior on DBLink?

rot=> SELECT user, current_database();
current_user | current_database
--------------+------------------
sa_rot | rot
(1 registro)

rot=> SELECT *
rot-> FROM dblink('dbname=escola',
rot(> 'SELECT user, current_database()')
rot-> AS (usr name, db name);
usr | db
----------+--------
postgres | escola
(1 registro)

This way, I fear DBLink functions should become a vulnerability issue on my
database.
Is there any way to protect or override this setting? Or it should be done
on pg_hba.conf only?

--
Regards,

Rodrigo Hjort
http://icewall.org/~hjort

Rodrigo Hjort wrote:
> Is this the regular behavior on DBLink?
>
> rot=> SELECT user, current_database();
> current_user | current_database
> --------------+------------------
> sa_rot | rot
> (1 registro)
>
> rot=> SELECT *
> rot-> FROM dblink('dbname=escola',
> rot(> 'SELECT user, current_database()')
> rot-> AS (usr name, db name);
> usr | db
> ----------+--------
> postgres | escola
> (1 registro)
>
> This way, I fear DBLink functions should become a vulnerability issue
> on my database.
> Is there any way to protect or override this setting? Or it should be
> done on pg_hba.conf only?

This issue has been thoroughly discussed before. You can read more about
it in f.ex these threads:
http://archives.postgresql.org/pgsql...6/msg00678.php

http://archives.postgresql.org/pgsql...7/msg00000.php

--
Tommy Gildseth


---------------------------(end of broadcast)---------------------------
TIP 5: don't forget to increase your free space map settings