-
Notifications
You must be signed in to change notification settings - Fork 902
Description
Did you use the FAQ section?
- Yes, I have read the FAQ and I found no solution/answer there.
When using pgsql
database as storage for pastes, if the account used for the connection do not have the right to SELECT
on pg_catalog.pg_user
table, the creation of a paste (and maybe the reading of one, but I didn't have a link to try) triggers a crash.
The crash log: PDOException: SQLSTATE[42501]: Insufficient privilege: 7 ERROR: permission denied for view pg_user in /srv/lib/Data/Database.php:98
.
This is linked to the query defined here: https://github.com/PrivateBin/PrivateBin/blob/master/lib/Data/Database.php#L600
Query added 12 year ago here:
421e6cb
Maybe there is a another or newer way to do this table list, without the cited right.
Steps to reproduce
- Use an pgsql config with an account without
SELECT
right onpg_catalog.pg_user
table - Try to create a paste.
What happens
Crash.
What should happen
No Crash
Basic information
Server address: N/A
Server OS: N/A
Webserver: N/A
Browser: N/A
PrivateBin version: 1.6.2
I can reproduce this issue on https://privatebin.net: No, only affects self-hosted.