bugfixes

README.md

@@ -5,6 +5,12 @@
 This project tries to find a way to allow users the management of the `VALID UNTIL` expiration clause by themself.
 All without granting `super` permissions and having a histoc of changes on a _pseudo-audit_ table
 
+| :warning: WARNING          |
+|:---------------------------|
+| Amazon RDS has its own instructions on README_RDS.md |
+|:---------------------------|
+| :warning: WARNING          |
+
 ## Instructions
 
 ### First deploy

grants_to_grant_rds.sql

@@ -5,7 +5,7 @@ grant usage on schema dba to dodger ;
 -- grant execute on the function change_my_password
 grant execute on function dba.change_my_password(text) to dodger;
 -- grant execute on the function change_valid_until
-grant execute on function dba.change_valid_until(text) to dodger;
+grant execute on function dba.change_valid_until(text, text) to dodger;
 
 -- only insert is needed to allow audit trace
 GRANT INSERT ON TABLE dba.pwdhistory TO dodger;

passchanger.sql

@@ -49,30 +49,35 @@ AS $BODY$
 declare
    _invokingfunction text := '';
    _matches text;
-   _password_lifetime int := 120;  -- specify password lifetime
+    --_password_lifetime text := '120 days';  -- specify password lifetime
    _retval  INTEGER;
+    _expiration_date text;
 begin
+    select now() + interval '120 days' into _expiration_date ;
     select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
+    -- first, checking the invoking function
 --     raise notice 'Invoking function: %', _invokingfunction;
     --_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
     _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
 --     raise notice 'Matches: %', _matches;
     if _matches IS NOT NULL then
+        -- then checking the regex for the password
       EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
       return 0;
         _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
         if _matches IS NOT NULL then
             --EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
-            EXECUTE format('ALTER ROLE ''%I'' WITH PASSWORD ''%L'' VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime)
+            EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval ''%I days'' ;', _usename, _thepassword, _password_lifetime);
-            INTO _retval;
+            -- INTO _retval;
-            RETURN _retval;
+            RETURN 0;
         else
             raise exception 'Regular expresion for password check failed'
             using errcode = '22023'  -- 22023 = "invalid_parameter_value'
             , detail = 'Check your generated password an try again'
             , hint = 'Read the official documentation' ;
         end if;
-    else  -- also catches NULL
+    else  
+      -- also catches NULL
       -- raise custom error
       raise exception 'You''re not allowed to run this function directly'
       using errcode = '22023'  -- 22023 = "invalid_parameter_value'
@@ -82,11 +87,9 @@ begin
 end
 $BODY$;
 
-ALTER FUNCTION dba.change_valid_until(text)
+ALTER FUNCTION dba.change_valid_until(text) OWNER TO dba;
-    OWNER TO dba;
 REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text) From PUBLIC;
 
-
 CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
     RETURNS integer
     SECURITY INVOKER
@@ -131,7 +134,6 @@ begin
 end
 $BODY$;
 
-ALTER FUNCTION dba.change_my_password(text)
+ALTER FUNCTION dba.change_my_password(text) OWNER TO dba;
-    OWNER TO dba;
 REVOKE EXECUTE ON FUNCTION dba.change_my_password(text) From PUBLIC;
 

passchanger_rds.sql

@@ -52,23 +52,23 @@ AS $BODY$
 declare
     _invokingfunction text := '';
     _matches text;
-   _password_lifetime int := 120;  -- specify password lifetime
+    --_password_lifetime text := '120 days';  -- specify password lifetime
     _retval  INTEGER;
     _expiration_date text;
 begin
     select now() + interval '120 days' into _expiration_date ;
     select query into _invokingfunction from pg_stat_activity where pid = pg_backend_pid() ;
---     raise notice 'Invoking function: %', _invokingfunction;
+    -- first, checking the invoking function
-    --_matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
     _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
 --     raise notice 'Matches: %', _matches;
     if _matches IS NOT NULL then
---        _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''\\)[[:space:]]{0,};' , 'i');
+        -- then checking the regex for the password
-        _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
+        _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\([[:space:]]{0,}''([[:alnum:]]|@|\\$|#|%|\\^|&|\\*|\\(|\\)|\\_|\\+|\\{|\\}|\\||<|>|\\?|=|!){11,100}''[[:space:]]{0,}\\)[[:space:]]{0,};' , 'i');
+        -- catch-all regexp, avoid using it
+        -- _matches := regexp_matches(_invokingfunction, E'select dba\.change_my_password\\(.*\\)[[:space:]]{0,};' , 'i');
         if _matches IS NOT NULL then
-            --EXECUTE format('update pg_catalog.pg_authid set rolvaliduntil=now() + interval ''120 days'' where rolname=''%I'' ', _usename);
+            --EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval %L days ;', _usename, _thepassword, _password_lifetime);
-            EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL ''%I'' ;', _usename, _thepassword, _expiration_date);
+            EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL %L ;', _usename, _thepassword, _expiration_date);
-            --EXECUTE format('ALTER ROLE %I WITH PASSWORD %L VALID UNTIL now() + interval ''120 days'' ;', _usename, _thepassword);
             -- INTO _retval;
             RETURN 0;
         else
@@ -77,7 +77,8 @@ begin
             , detail = 'Check your generated password (' || _thepassword || ') an try again'
             , hint = 'Read the official documentation' ;
         end if;
-    else  -- also catches NULL
+    else  
+      -- also catches NULL
       -- raise custom error
       raise exception 'You''re not allowed to run this function directly'
       using errcode = '22023'  -- 22023 = "invalid_parameter_value'
@@ -87,11 +88,9 @@ begin
 end
 $BODY$;
 
--- ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO postgres;
 ALTER FUNCTION dba.change_valid_until(text, text) OWNER TO dba;
 REVOKE EXECUTE ON FUNCTION dba.change_valid_until(text, text) From PUBLIC;
 
-
 CREATE OR REPLACE FUNCTION dba.change_my_password(_password text)
     RETURNS integer
     SECURITY INVOKER
@@ -129,10 +128,6 @@ begin
           (usename, usename_addres, application_name, password, changed_on)
     values (_usename, _useraddress, _userapp, md5(_password),now());
 
---
---
---
-
     return 0;
 end
 $BODY$;