Merge branch 'master' into remove-grant-select-from-cdb_tablemetadata-to-public

Makefile

@@ -1,7 +1,7 @@
 # cartodb/Makefile
 
 EXTENSION = cartodb
-EXTVERSION = 0.5.2
+EXTVERSION = 0.5.3
 
 SED = sed
 
@@ -31,6 +31,7 @@ UPGRADABLE = \
   0.4.1 \
   0.5.0 \
   0.5.1 \
+  0.5.2 \
   $(EXTVERSION)dev \
   $(EXTVERSION)next \
   $(END)
@@ -91,14 +92,14 @@ legacy_regress: $(REGRESS_OLD) Makefile
 	for f in $(REGRESS_OLD); do \
     tn=`basename $${f} .sql`; \
     of=sql/test/$${tn}.sql; \
-    echo '\\set ECHO off' > $${of}; \
+    echo '\\set ECHO none' > $${of}; \
     echo '\\a' >> $${of}; \
     echo '\\t' >> $${of}; \
     echo '\\set QUIET off' >> $${of}; \
     cat $${f} | \
       $(SED) -e 's/public\./cartodb./g' >> $${of}; \
     exp=expected/test/$${tn}.out; \
-    echo '\\set ECHO off' > $${exp}; \
+    echo '\\set ECHO none' > $${exp}; \
     cat test/$${tn}_expect >> $${exp}; \
   done
 

NEWS.md

@@ -1,3 +1,8 @@
+0.5.3 (2015-02-xx)
+------------------
+* Fixed secuity problem related with system tables
+* Changed quota checks to use `pg_relation_size` instead of `pg_total_relation_size`
+
 0.5.2 (2015-01-29)
 ------------------
 * Improvement: make CDB_UserDataSize functions much faster.

scripts-available/CDB_QueryTables.sql

@@ -16,9 +16,9 @@ BEGIN
 
   FOR rec IN SELECT CDB_QueryStatements(query) q LOOP
 
-    IF NOT ( rec.q ilike 'select %' or rec.q ilike 'with %' ) THEN
+    IF NOT ( rec.q ilike 'select%' or rec.q ilike 'with%' ) THEN
-      --RAISE WARNING 'Skipping %', rec.q;
+        --RAISE WARNING 'Skipping %', rec.q;
-      CONTINUE;
+        CONTINUE;
     END IF;
 
     BEGIN

scripts-available/CDB_Quota.sql

@@ -24,7 +24,7 @@ BEGIN
     FROM user_tables
   ),
   sizes AS (
-    SELECT COALESCE(INT8(SUM(pg_total_relation_size('"' || schema_name || '"."' || table_name || '"')))) table_size,
+    SELECT COALESCE(INT8(SUM(pg_relation_size('"' || schema_name || '"."' || table_name || '"')))) table_size,
       CASE
         WHEN is_overview THEN 0
 	WHEN is_raster THEN 1

test/CDB_CartodbfyTableTest.sql

@@ -1,5 +1,5 @@
 SET client_min_messages TO error;
-\set VERBOSITY terse;
+\set VERBOSITY default
 
 CREATE OR REPLACE FUNCTION CDB_CartodbfyTableCheck(tabname regclass, label text)
 RETURNS text AS

test/CDB_QueryTablesTest.sql

@@ -31,3 +31,7 @@ create table sc.test (a int);
 insert into sc.test values (1);
 WITH inp AS ( select 'select * from sc.test'::text as q )
  SELECT q, CDB_QueryTables(q) from inp;
+
+WITH inp AS ( select 'SELECT
+* FROM geometry_columns'::text as q )
+ SELECT q, CDB_QueryTables(q) from inp;

test/CDB_QueryTablesTest_expect

@@ -13,3 +13,5 @@ CREATE SCHEMA
 CREATE TABLE
 INSERT 0 1
 select * from sc.test|{sc.test}
+SELECT
+* FROM geometry_columns|{pg_catalog.pg_attribute,pg_catalog.pg_class,pg_catalog.pg_namespace,pg_catalog.pg_type}

test/CDB_QuotaTest.sql

@@ -1,5 +1,6 @@
-set client_min_messages to ERROR;
+set client_min_messages to error;
-\set VERBOSITY terse
+\set VERBOSITY default
+
 CREATE TABLE big(a int);
 -- Try the legacy interface
 -- See https://github.com/CartoDB/cartodb-postgresql/issues/13
@@ -9,8 +10,10 @@ INSERT INTO big VALUES (1); -- allowed, check runs before
 INSERT INTO big VALUES (1); -- disallowed, quota exceeds before
 SELECT CDB_SetUserQuotaInBytes(0);
 SELECT CDB_CartodbfyTable('big');
-INSERT INTO big SELECT generate_series(1,1024);
+INSERT INTO big SELECT generate_series(1,2048);
-SELECT CDB_SetUserQuotaInBytes(8);
+INSERT INTO big SELECT generate_series(1,2048);
+INSERT INTO big SELECT generate_series(1,2048);
+SELECT CDB_SetUserQuotaInBytes(2);
 INSERT INTO big VALUES (1);
 SELECT CDB_SetUserQuotaInBytes(0);
 INSERT INTO big VALUES (1);

test/CDB_QuotaTest_expect

@@ -5,9 +5,11 @@ INSERT 0 1
 ERROR:  Quota exceeded by 3.9990234375KB
 0
 
-INSERT 0 1024
+INSERT 0 2048
-8
+INSERT 0 2048
-ERROR:  Quota exceeded by 123.9921875KB
+INSERT 0 2048
+2
+ERROR:  Quota exceeded by 159.998046875KB
 0
 INSERT 0 1
 DROP TABLE

test/extension/test.sh

@@ -253,7 +253,7 @@ function run_tests() {
 # Tests quota checking taking into account both geom and raster tables
 function test_quota_for_each_user() {
     # Normal tables add 4096 bytes
-    # Raster tables with overview constraints add 16384 bytes
+    # Raster tables no longer add anything so also count as 4096
 
     sql cdb_testmember_1 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_1'::TEXT);" should 4096
     sql cdb_testmember_2 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_2'::TEXT);" should 4096
@@ -261,13 +261,13 @@ function test_quota_for_each_user() {
     create_raster_table cdb_testmember_1 raster_1
     create_raster_table cdb_testmember_2 raster_2
 
-    sql cdb_testmember_1 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_1'::TEXT);" should 20480
+    sql cdb_testmember_1 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_1'::TEXT);" should 4096
-    sql cdb_testmember_2 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_2'::TEXT);" should 20480
+    sql cdb_testmember_2 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_2'::TEXT);" should 4096
 
     create_raster_table cdb_testmember_1 raster_3
 
-    sql cdb_testmember_1 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_1'::TEXT);" should 36864
+    sql cdb_testmember_1 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_1'::TEXT);" should 4096
-    sql cdb_testmember_2 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_2'::TEXT);" should 20480
+    sql cdb_testmember_2 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_2'::TEXT);" should 4096
 
     drop_raster_table cdb_testmember_1 raster_1
     drop_raster_table cdb_testmember_2 raster_2