3 Commits

Author SHA1 Message Date
Nikhil Sontakke
ed8ca318c0 Quote username identifier appropriately
Need to use quote_ident() on the user roles. Otherwise the
extension scripts will fail.

Co-authored-by: Mats Kindahl <mats@timescale.com>
2023-04-28 16:53:43 +05:30
Mats Kindahl
15d33f0624 Add option to compile without telemetry
Add option `USE_TELEMETRY` that can be used to exclude telemetry from
the compile.

Telemetry-specific SQL is moved, which is only included when extension
is compiled with telemetry and the notice is changed so that the
message about telemetry is not printed when Telemetry is not compiled
in.

The following code is not compiled in when telemetry is not used:
- Cross-module functions for telemetry.
- Checks for telemetry job in job execution.
- GUC variables `telemetry_level` and `telemetry_cloud`.

Telemetry subsystem is not included when compiling without telemetry,
which requires some functions to be moved out of the telemetry
subsystem:
- Metadata handling is moved out of the telemetry module since it is
  used not only with telemetry.
- UUID functions are moved into a separate module instead of being
  part of the telemetry subsystem.
- Telemetry functions are either added or removed when updating from a
  previous version.

Tests are updated to:
- Not use telemetry functions to get UUID or Metadata and instead use
  the moved UUID and metadata functions.
- Not include telemetry information in tests that do not require it.
- Configuration files do not set telemetry variables when telemetry is
  not compiled in.
- Replaced usage of telemetry functions in non-telemetry tests with
  other sources of same information.

Fixes #3931
2022-03-03 12:21:07 +01:00
Sven Klemm
c8b8516e46 Fix extension installation privilege escalation
TimescaleDB was vulnerable to a privilege escalation attack in
the extension installation script. An attacker could precreate
objects normally owned by the extension and get those objects
used in the installation script since the script would only try
to create them if they did not already exist. Thanks to Pedro
Gallegos for reporting the problem.

This patch changes the schema, table and function creation to fail
and abort the installation when the object already exists instead
of using the existing object.

Security: CVE-2022-24128
2022-02-09 17:53:20 +01:00