Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0004078Openbravo ERPA. Platformpublic2008-06-19 16:472008-08-21 19:29
Reporterplujan 
Assigned Tocromero 
PrioritynormalSeveritymajorReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOS10OS VersionXPsp2
Product Version2.40alpha-r3 
Target VersionFixed in Versionpi 
Merge Request Status
Review Assigned To
OBNetwork customerNo
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0004078: Database user on PostgreSQL should not have SuperUser privileges
DescriptionDatabase user on PostgreSQL should not have SuperUser privileges

This is a security vulnerability because if hackers manage to get access to this user, they will gain control of the full database.

This is a particularly serious concern for those customers who deploy Openbravo in an PostgreSQL database that houses other applications as well.
Steps To ReproduceConnect to PostgreSQL and verify privileges.
Proposed Solution
Additional Information
TagsNo tags attached.
Relationships
related to defect 00001242.40 closed alostale Openbravo database schame has dba privileges 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2008-06-19 16:47plujanNew Issue
2008-06-19 16:47plujanAssigned To => cromero
2008-06-19 16:47plujansf_bug_id0 => 1997918
2008-06-19 16:47plujanOBNetwork customer => No
2008-06-19 16:58cromeroRelationship addedrelated to 0000124
2008-06-19 17:01cromeroAssigned Tocromero => marvintm
2008-06-19 17:01cromeroStatusnew => scheduled
2008-06-20 11:15cromeroAssigned Tomarvintm => cromero
2008-06-20 11:46svnbotCheckin
2008-06-20 11:46svnbotNote Added: 0007903
2008-06-20 11:46svnbotStatusscheduled => resolved
2008-06-20 11:46svnbotResolutionopen => fixed
2008-06-20 11:46svnbotsvn_revision => 5240
2008-06-20 12:45svnbotCheckin
2008-06-20 12:45svnbotNote Added: 0007909
2008-06-20 12:45svnbotsvn_revision5240 => 5245
2008-06-20 12:56cromeroNote Added: 0007910
2008-08-21 19:29psarobeRegression testing => No
2008-08-21 19:29psarobeStatusresolved => closed
2008-08-21 19:29psarobeFixed in Version => trunk

Notes
(0007903)
svnbot   
2008-06-20 11:46   
Repository: openbravo
Revision: 5240
Author: cromeroherrero
Date: 2008-06-20 11:46:42 +0200 (Fri, 20 Jun 2008)

Fixed bug 4078: Database user on PostgreSQL should not have SuperUser privileges
Now User is created without SuperUser priviledges.

---
U trunk/src-db/database/build.xml
---

https://dev.openbravo.com/websvn/openbravo/?rev=5240&sc=1 [^]
(0007909)
svnbot   
2008-06-20 12:45   
Repository: openbravo
Revision: 5245
Author: cromeroherrero
Date: 2008-06-20 12:45:02 +0200 (Fri, 20 Jun 2008)

Fixed bug 4078: Database user on PostgreSQL should not have SuperUser privileges
* Reverted modification since SuperUser priviledges are needed to disable constraints (used in delete_client process).

---
U trunk/src-db/database/build.xml
---

https://dev.openbravo.com/websvn/openbravo/?rev=5245&sc=1 [^]
(0007910)
cromero   
2008-06-20 12:56   
A new feature request has been added in order to solve this bug:
https://issues.openbravo.com/view.php?id=4099 [^]

While Delete_Client needs SuperUser privileges to disable/enable constraints, the role needs to be created with that privileges.