summaryrefslogtreecommitdiff
path: root/contrib/sslinfo
diff options
context:
space:
mode:
authorTom Lane <tgl@sss.pgh.pa.us>2020-02-19 16:59:14 -0500
committerTom Lane <tgl@sss.pgh.pa.us>2020-02-19 16:59:14 -0500
commit70a7732007bc4689f4c7a44e738eb2d892dac1e3 (patch)
treeee0e3600986e53e6028658dbe2d1bfad3e1f7606 /contrib/sslinfo
parent2f9c46a32b43d72c9384378827ee51fde896807c (diff)
downloadpostgresql-70a7732007bc4689f4c7a44e738eb2d892dac1e3.tar.gz
Remove support for upgrading extensions from "unpackaged" state.
Andres Freund pointed out that allowing non-superusers to run "CREATE EXTENSION ... FROM unpackaged" has security risks, since the unpackaged-to-1.0 scripts don't try to verify that the existing objects they're modifying are what they expect. Just attaching such objects to an extension doesn't seem too dangerous, but some of them do more than that. We could have resolved this, perhaps, by still requiring superuser privilege to use the FROM option. However, it's fair to ask just what we're accomplishing by continuing to lug the unpackaged-to-1.0 scripts forward. None of them have received any real testing since 9.1 days, so they may not even work anymore (even assuming that one could still load the previous "loose" object definitions into a v13 database). And an installation that's trying to go from pre-9.1 to v13 or later in one jump is going to have worse compatibility problems than whether there's a trivial way to convert their contrib modules into extension style. Hence, let's just drop both those scripts and the core-code support for "CREATE EXTENSION ... FROM". Discussion: https://postgr.es/m/20200213233015.r6rnubcvl4egdh5r@alap3.anarazel.de
Diffstat (limited to 'contrib/sslinfo')
-rw-r--r--contrib/sslinfo/Makefile3
-rw-r--r--contrib/sslinfo/sslinfo--unpackaged--1.0.sql22
2 files changed, 1 insertions, 24 deletions
diff --git a/contrib/sslinfo/Makefile b/contrib/sslinfo/Makefile
index 2363c3f0e9..dd1ff83b16 100644
--- a/contrib/sslinfo/Makefile
+++ b/contrib/sslinfo/Makefile
@@ -6,8 +6,7 @@ OBJS = \
sslinfo.o
EXTENSION = sslinfo
-DATA = sslinfo--1.2.sql sslinfo--1.1--1.2.sql sslinfo--1.0--1.1.sql \
- sslinfo--unpackaged--1.0.sql
+DATA = sslinfo--1.2.sql sslinfo--1.1--1.2.sql sslinfo--1.0--1.1.sql
PGFILEDESC = "sslinfo - information about client SSL certificate"
ifdef USE_PGXS
diff --git a/contrib/sslinfo/sslinfo--unpackaged--1.0.sql b/contrib/sslinfo/sslinfo--unpackaged--1.0.sql
deleted file mode 100644
index 07407acb54..0000000000
--- a/contrib/sslinfo/sslinfo--unpackaged--1.0.sql
+++ /dev/null
@@ -1,22 +0,0 @@
-/* contrib/sslinfo/sslinfo--unpackaged--1.0.sql */
-
--- complain if script is sourced in psql, rather than via CREATE EXTENSION
-\echo Use "CREATE EXTENSION sslinfo FROM unpackaged" to load this file. \quit
-
-ALTER EXTENSION sslinfo ADD function ssl_client_serial();
-ALTER EXTENSION sslinfo ADD function ssl_is_used();
-ALTER EXTENSION sslinfo ADD function ssl_client_cert_present();
-ALTER EXTENSION sslinfo ADD function ssl_client_dn_field(text);
-ALTER EXTENSION sslinfo ADD function ssl_issuer_field(text);
-ALTER EXTENSION sslinfo ADD function ssl_client_dn();
-ALTER EXTENSION sslinfo ADD function ssl_issuer_dn();
-
--- These functions were not in 9.0:
-
-CREATE FUNCTION ssl_version() RETURNS text
-AS 'MODULE_PATHNAME', 'ssl_version'
-LANGUAGE C STRICT;
-
-CREATE FUNCTION ssl_cipher() RETURNS text
-AS 'MODULE_PATHNAME', 'ssl_cipher'
-LANGUAGE C STRICT;