Re: Bug #2324: pg_connect connects as web server, not script owner

On 19 Sep 1999 mpg4@duluoz.net wrote: > From: mpg4@duluoz.net > Operating system: Linux 2.0.36 > PHP version: 3.0.12 > PHP Bug Type: PostgreSQL related > Bug description: pg_connect connects as web server, not script owner > > The PostgreSQL functions are run as the web server user, not as the > owner of the script that called them. This means that any user can > view the contents of any database that the web server can see. This is not PHP related, however... It has to do with your PostgreSQL setup... IF you've setup PG to not use passwords on a DB, then anybody can access that DB, as long as they're granted select, insert, delete, update, whatever - permissions on that DB. There is no way to get around this - even if you use libpq in a "normal" C program (I have this "problem" all the time) - the functions run as the user who started the program, and not as the user who owns the DB. There is preciously little you can do about this, other than possibly requiring a password for logins to your DB as the user that your webserver runs under. (That last sentence was ugly - just set up PostgreSQL to require passwords for connections to the DB as that user.) -- Dominic J. Eidson "Baruk Khazad! Khazad ai-menu!" - Gimli -------------------------------------------------------------------------------- http://www.the-infinite.org/ http://www.the-infinite.org/~dominic/