Skip to content

pgsql: crash when serice account do not have SELECT right on pg_catalog.pg_user #1361

@Lowaiz

Description

@Lowaiz

Did you use the FAQ section?

  • Yes, I have read the FAQ and I found no solution/answer there.

When using pgsql database as storage for pastes, if the account used for the connection do not have the right to SELECT on pg_catalog.pg_user table, the creation of a paste (and maybe the reading of one, but I didn't have a link to try) triggers a crash.

The crash log: PDOException: SQLSTATE[42501]: Insufficient privilege: 7 ERROR: permission denied for view pg_user in /srv/lib/Data/Database.php:98.

This is linked to the query defined here: https://github.com/PrivateBin/PrivateBin/blob/master/lib/Data/Database.php#L600

Query added 12 year ago here:
421e6cb

Maybe there is a another or newer way to do this table list, without the cited right.

Steps to reproduce

  1. Use an pgsql config with an account without SELECT right on pg_catalog.pg_user table
  2. Try to create a paste.

What happens

Crash.

What should happen

No Crash

Basic information

Server address: N/A

Server OS: N/A

Webserver: N/A

Browser: N/A

PrivateBin version: 1.6.2

I can reproduce this issue on https://privatebin.net: No, only affects self-hosted.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions