public/postgresql_passchanger_function
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

security changes on change_valid_until function

Browse Source
This commit is contained in:
dodger 2022-01-05 13:07:06 +01:00
parent 736c6871aa
commit 098de25253
1 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
passchanger.sql
View File

@ -8,6 +8,7 @@ create role dba with NOLOGIN NOINHERIT ;
-- grants for dba -- grants for dba
grant select on pg_catalog.pg_authid to dba ; grant select on pg_catalog.pg_authid to dba ;
grant update (rolvaliduntil) on pg_catalog.pg_authid to dba ; grant update (rolvaliduntil) on pg_catalog.pg_authid to dba ;
grant pg_read_all_stats to dba ;
-- password history table -- password history table
@ -32,7 +33,6 @@ ALTER TABLE IF EXISTS dba.pwdhistory
-- ###################################### -- ######################################
-- ###################################### -- ######################################
CREATE OR REPLACE FUNCTION dba.change_valid_until(_usename text) CREATE OR REPLACE FUNCTION dba.change_valid_until(_usename text)
RETURNS integer RETURNS integer
SECURITY DEFINER SECURITY DEFINER
@ -40,14 +40,24 @@ CREATE OR REPLACE FUNCTION dba.change_valid_until(_usename text)
COST 100 COST 100
VOLATILE PARALLEL UNSAFE VOLATILE PARALLEL UNSAFE
AS $BODY$ AS $BODY$
declare
_invokingfunction text := '';
_matches text;
begin begin
select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
-- raise notice 'Invoking function: %', _invokingfunction;
_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=){1,100}''\\)[[:space:]]{0,};' , 'i');
-- raise notice 'Matches: %', _matches;
if _matches IS NOT NULL then
EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename); EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
return 0; return 0;
exception else -- also catches NULL
-- trap existing error and re-raise with added detail -- raise custom error
when unique_violation then -- = error code 23505 raise exception 'You''re not allowed to run this function directly'
raise unique_violation using errcode = '22023' -- 22023 = "invalid_parameter_value'
using detail = 'Error updating VALID UNTIL.'; , detail = 'Please call dba.change_my_password function.'
, hint = 'Don''t mess with the devil';
end if;
end end
$BODY$; $BODY$;