#69 Updated version at makefile

try to fix security problem

Makefile

@@ -1,7 +1,7 @@
 # cartodb/Makefile
 
 EXTENSION = cartodb
-EXTVERSION = 0.5.0
+EXTVERSION = 0.5.3
 
 SED = sed
 
@@ -29,6 +29,9 @@ UPGRADABLE = \
   0.3.6 \
   0.4.0 \
   0.4.1 \
+  0.5.0 \
+  0.5.1 \
+  0.5.2 \
   $(EXTVERSION)dev \
   $(EXTVERSION)next \
   $(END)
@@ -89,14 +92,14 @@ legacy_regress: $(REGRESS_OLD) Makefile
 	for f in $(REGRESS_OLD); do \
     tn=`basename $${f} .sql`; \
     of=sql/test/$${tn}.sql; \
-    echo '\\set ECHO off' > $${of}; \
+    echo '\\set ECHO none' > $${of}; \
     echo '\\a' >> $${of}; \
     echo '\\t' >> $${of}; \
     echo '\\set QUIET off' >> $${of}; \
     cat $${f} | \
       $(SED) -e 's/public\./cartodb./g' >> $${of}; \
     exp=expected/test/$${tn}.out; \
-    echo '\\set ECHO off' > $${exp}; \
+    echo '\\set ECHO none' > $${exp}; \
     cat test/$${tn}_expect >> $${exp}; \
   done
 
@@ -108,5 +111,5 @@ test_extension_new:
 
 legacy_tests: legacy_regress 
 
-installcheck: legacy_tests #test_extension_new test_organization
+installcheck: legacy_tests test_extension_new test_organization
 

NEWS.md

@@ -1,4 +1,16 @@
-0.5.0 (2014-09-21)
+0.5.X ()
+------------------
+* Fixed secuity problem related with system tables
+
+0.5.2 (2015-01-29)
+------------------
+* Improvement: make CDB_UserDataSize functions much faster.
+
+0.5.1 (2014-11-21)
+------------------
+* Bugfix: Quota check and some organization permissions functions were not properly escaping table name.
+
+0.5.0 (2014-11-03)
 ------------------
 * Support of raster tables for cartodbfication
 * Modified quota functions: vector tables stay the same, raster tables count as full size (as have no

scripts-available/CDB_Organizations.sql

@@ -35,7 +35,7 @@ FUNCTION cartodb.CDB_Organization_Add_Table_Read_Permission(from_schema text, ta
 AS $$
 BEGIN
     EXECUTE 'GRANT USAGE ON SCHEMA "' || from_schema || '" TO "' || to_role_name || '"';
-    EXECUTE 'GRANT SELECT ON "' || from_schema || '".' || table_name || ' TO "' || to_role_name || '"';
+    EXECUTE 'GRANT SELECT ON "' || from_schema || '"."' || table_name || '" TO "' || to_role_name || '"';
 END
 $$ LANGUAGE PLPGSQL VOLATILE;
 
@@ -54,7 +54,7 @@ FUNCTION cartodb.CDB_Organization_Add_Table_Read_Write_Permission(from_schema te
 AS $$
 BEGIN
     EXECUTE 'GRANT USAGE ON SCHEMA "' || from_schema || '" TO "' || to_role_name || '"';
-    EXECUTE 'GRANT SELECT, INSERT, UPDATE, DELETE ON "' || from_schema || '".' || table_name || ' TO "' || to_role_name || '"';
+    EXECUTE 'GRANT SELECT, INSERT, UPDATE, DELETE ON "' || from_schema || '"."' || table_name || '" TO "' || to_role_name || '"';
 END
 $$ LANGUAGE PLPGSQL VOLATILE;
 
@@ -73,7 +73,7 @@ FUNCTION cartodb.CDB_Organization_Remove_Access_Permission(from_schema text, tab
     RETURNS void
 AS $$
 BEGIN
-    EXECUTE 'REVOKE ALL PRIVILEGES ON TABLE "' || from_schema || '".' || table_name || ' FROM "' || to_role_name || '"';
+    EXECUTE 'REVOKE ALL PRIVILEGES ON TABLE "' || from_schema || '"."' || table_name || '" FROM "' || to_role_name || '"';
     -- EXECUTE 'REVOKE USAGE ON SCHEMA ' || from_schema || ' FROM "' || to_role_name || '"';
     -- We need to revoke usage on schema only if we are revoking privileges from the last table where to_role_name has
     -- any permission granted within the schema from_schema

scripts-available/CDB_QueryTables.sql

@@ -16,9 +16,9 @@ BEGIN
 
   FOR rec IN SELECT CDB_QueryStatements(query) q LOOP
 
-    IF NOT ( rec.q ilike 'select %' or rec.q ilike 'with %' ) THEN
-      --RAISE WARNING 'Skipping %', rec.q;
-      CONTINUE;
+    IF NOT ( rec.q ilike 'select%' or rec.q ilike 'with%' ) THEN
+        --RAISE WARNING 'Skipping %', rec.q;
+        CONTINUE;
     END IF;
 
     BEGIN

scripts-available/CDB_Quota.sql

@@ -3,50 +3,41 @@ CREATE OR REPLACE FUNCTION CDB_UserDataSize(schema_name TEXT)
 RETURNS bigint AS
 $$
 DECLARE
-  quota_vector INT8;
-  quota_raster INT8;
+  total_size INT8;
 BEGIN
-  -- TODO: double check queries. Maybe use CDB_TableMetadata for lookup?
-  --  Also, "table_name" sounds sensible to search_path
-
-  -- Division by 2 is for not counting the_geom_webmercator
-  SELECT COALESCE(INT8(SUM(pg_total_relation_size(schema_name || '.' || table_name)) / 2), 0) INTO quota_vector
-  FROM information_schema.tables
-  WHERE table_catalog = current_database() AND table_schema = schema_name
-    AND table_name != 'spatial_ref_sys'
-    AND table_name != 'cdb_tablemetadata'
-    AND table_type = 'BASE TABLE'
-    -- exclude raster overview tables
-    AND table_name NOT IN (
-      SELECT o_table_name FROM raster_overviews
+  WITH raster_tables AS (
+    SELECT o_table_name, r_table_name FROM raster_overviews
       WHERE o_table_schema = schema_name AND o_table_catalog = current_database()
-    )
-    -- exclude raster "main" tables
-    AND table_name NOT IN (
-      SELECT r_table_name FROM raster_overviews
-      WHERE r_table_name = table_name
-        AND o_table_schema = schema_name AND o_table_catalog = current_database()
-    );
+  ),
+  user_tables AS (
+    SELECT table_name FROM information_schema.tables
+      WHERE table_catalog = current_database() AND table_schema = schema_name
+        AND table_name != 'spatial_ref_sys'
+        AND table_name != 'cdb_tablemetadata'
+        AND table_type = 'BASE TABLE'
+  ),
+  table_cat AS (
+    SELECT
+      table_name,
+      EXISTS(select * from raster_tables where o_table_name = table_name) AS is_overview,
+      EXISTS(SELECT * FROM raster_tables WHERE r_table_name = table_name) AS is_raster
+    FROM user_tables
+  ),
+  sizes AS (
+    SELECT COALESCE(INT8(SUM(pg_relation_size('"' || schema_name || '"."' || table_name || '"')))) table_size,
+      CASE
+        WHEN is_overview THEN 0
+	WHEN is_raster THEN 1
+	ELSE 0.5 -- Division by 2 is for not counting the_geom_webmercator
+      END AS multiplier FROM table_cat GROUP BY is_overview, is_raster
+  )
+  SELECT sum(table_size*multiplier)::int8 INTO total_size FROM sizes;
 
-  SELECT COALESCE(INT8(SUM(pg_total_relation_size(schema_name || '.' || table_name))), 0) INTO quota_raster
-  FROM information_schema.tables
-  WHERE table_catalog = current_database() AND table_schema = schema_name
-    AND table_name != 'spatial_ref_sys'
-    AND table_name != 'cdb_tablemetadata'
-    AND table_type = 'BASE TABLE'
-    -- exclude raster overview tables
-    AND table_name NOT IN (
-      SELECT o_table_name FROM raster_overviews
-      WHERE o_table_schema = schema_name AND o_table_catalog = current_database()
-    )
-    -- filter to raster "main" tables
-    AND table_name IN (
-      SELECT r_table_name FROM raster_overviews
-      WHERE r_table_name = table_name
-        AND o_table_schema = schema_name AND o_table_catalog = current_database()
-    );
-
-  RETURN quota_vector + quota_raster;
+  IF total_size IS NOT NULL THEN
+    RETURN total_size;
+  ELSE
+    RETURN 0;
+  END IF;
 END;
 $$
 LANGUAGE 'plpgsql' VOLATILE;

test/CDB_CartodbfyTableTest.sql

@@ -1,5 +1,5 @@
 SET client_min_messages TO error;
-\set VERBOSITY terse;
+\set VERBOSITY default
 
 CREATE OR REPLACE FUNCTION CDB_CartodbfyTableCheck(tabname regclass, label text)
 RETURNS text AS

test/CDB_QueryTablesTest.sql

@@ -31,3 +31,7 @@ create table sc.test (a int);
 insert into sc.test values (1);
 WITH inp AS ( select 'select * from sc.test'::text as q )
  SELECT q, CDB_QueryTables(q) from inp;
+
+WITH inp AS ( select 'SELECT
+* FROM geometry_columns'::text as q )
+ SELECT q, CDB_QueryTables(q) from inp;

test/CDB_QueryTablesTest_expect

@@ -13,3 +13,5 @@ CREATE SCHEMA
 CREATE TABLE
 INSERT 0 1
 select * from sc.test|{sc.test}
+SELECT
+* FROM geometry_columns|{pg_catalog.pg_attribute,pg_catalog.pg_class,pg_catalog.pg_namespace,pg_catalog.pg_type}

test/CDB_QuotaTest.sql

@@ -1,5 +1,6 @@
-set client_min_messages to ERROR;
-\set VERBOSITY terse
+set client_min_messages to error;
+\set VERBOSITY default
+
 CREATE TABLE big(a int);
 -- Try the legacy interface
 -- See https://github.com/CartoDB/cartodb-postgresql/issues/13
@@ -9,8 +10,10 @@ INSERT INTO big VALUES (1); -- allowed, check runs before
 INSERT INTO big VALUES (1); -- disallowed, quota exceeds before
 SELECT CDB_SetUserQuotaInBytes(0);
 SELECT CDB_CartodbfyTable('big');
-INSERT INTO big SELECT generate_series(1,1024);
-SELECT CDB_SetUserQuotaInBytes(8);
+INSERT INTO big SELECT generate_series(1,2048);
+INSERT INTO big SELECT generate_series(1,2048);
+INSERT INTO big SELECT generate_series(1,2048);
+SELECT CDB_SetUserQuotaInBytes(2);
 INSERT INTO big VALUES (1);
 SELECT CDB_SetUserQuotaInBytes(0);
 INSERT INTO big VALUES (1);

test/CDB_QuotaTest_expect

@@ -5,9 +5,11 @@ INSERT 0 1
 ERROR:  Quota exceeded by 3.9990234375KB
 0
 
-INSERT 0 1024
-8
-ERROR:  Quota exceeded by 123.9921875KB
+INSERT 0 2048
+INSERT 0 2048
+INSERT 0 2048
+2
+ERROR:  Quota exceeded by 159.998046875KB
 0
 INSERT 0 1
 DROP TABLE

test/extension/test.sh

@@ -253,7 +253,7 @@ function run_tests() {
 # Tests quota checking taking into account both geom and raster tables
 function test_quota_for_each_user() {
     # Normal tables add 4096 bytes
-    # Raster tables with overview constraints add 16384 bytes
+    # Raster tables no longer add anything so also count as 4096
 
     sql cdb_testmember_1 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_1'::TEXT);" should 4096
     sql cdb_testmember_2 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_2'::TEXT);" should 4096
@@ -261,13 +261,13 @@ function test_quota_for_each_user() {
     create_raster_table cdb_testmember_1 raster_1
     create_raster_table cdb_testmember_2 raster_2
 
-    sql cdb_testmember_1 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_1'::TEXT);" should 20480
-    sql cdb_testmember_2 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_2'::TEXT);" should 20480
+    sql cdb_testmember_1 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_1'::TEXT);" should 4096
+    sql cdb_testmember_2 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_2'::TEXT);" should 4096
 
     create_raster_table cdb_testmember_1 raster_3
 
-    sql cdb_testmember_1 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_1'::TEXT);" should 36864
-    sql cdb_testmember_2 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_2'::TEXT);" should 20480
+    sql cdb_testmember_1 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_1'::TEXT);" should 4096
+    sql cdb_testmember_2 "SELECT cartodb.CDB_UserDataSize('cdb_testmember_2'::TEXT);" should 4096
 
     drop_raster_table cdb_testmember_1 raster_1
     drop_raster_table cdb_testmember_2 raster_2