The following block needs removing from manage-postgres-user.py. This statement is granting ALL privileges regardless of the parameter that gets passed in the payload:
|
execute_statement( |
|
"GRANT ALL ON DATABASE {} TO {};".format( |
|
database, postgres_user_username |
|
), |
|
postgres_master_username, |
|
postgres_master_password_source, |
|
postgres_master_password_source_type, |
|
) |
The following block needs removing from
manage-postgres-user.py. This statement is grantingALLprivileges regardless of the parameter that gets passed in the payload:manage-postgres-user/manage-postgresql-user.py
Lines 522 to 529 in a6f521c