This project is archived and is in readonly mode.
Rails Postgres Issue
-
CancelProfileIsBroken- Tag changed from 2.3.4, postgres to 2.3.4, bugmash, postgres
- Assigned user cleared.
-
Biju Devassy
- Assigned user set to José Valim
-
José Valim- Assigned user cleared.
-
Biju Devassy
- No changes were found…
-
Lucas de CastroThis problem was fixed: http://github.com/mneumann/postgres-pr/issues/closed/#issue/1
Update your postgres-pr gem to version 0.6.3 and all will work fine.
-
Jeremy Kemper- State changed from new to invalid
-
Mo Morsi
- Importance changed from to
Is this issue really invalid? We are still running into this problem w/ Rails 2.3.8.
Here's the thing, the activerecord postgres adapter claims to work w/ both the native C postgres adapter as well as the pure ruby one (postgres-pr)
http://github.com/rails/rails/blob/master/activerecord/lib/active_r...
http://api.rubyonrails.org/classes/ActiveRecord/ConnectionAdapters/...So even if one isn't using postgres-pr (which we are not) this should work.
Postgres-pr defines the necessary PGconn methods which the activerecord postgres adapter uses. The thing is, activerecord still checks to see if these methods are present on the PGconn class (via PGconn.respond_to?(:method_name)) before invoking them. That way if those methods don't exist (which I'm guessing they don't in the native postgres interface), no error is raised.
The problem is, this check never gets performed before the PGconn.quote_ident call.
The following patch adds this check around quote_ident, bringing it inline with the other PGconn method invocations, and resolving this issue:
--- activerecord-2.3.8/lib/active_record/connection_adapters/postgresql_adapter.rb.orig 2010-08-16 21:14:25.710395992 -0400 +++ activerecord-2.3.8/lib/active_record/connection_adapters/postgresql_adapter.rb 2010-08-16 21:15:33.091702801 -0400 @@ -407,7 +407,11 @@ module ActiveRecord # Quotes column names for use in SQL queries. def quote_column_name(name) #:nodoc: - PGconn.quote_ident(name.to_s) + if PGconn.respond_to?(:quote_ident) + PGconn.quote_ident(name.to_s) + else + %("#{name}") + end end # Quote date/time values for use in SQL input. Includes microseconds -
Mo Morsi
So apparently fixing this with the patch I described opens a security vulnerability as quote_ident escapes strings passed in to prevent sql injection attacks and such.
Here is an updated patch which simply just fails with a better error if quote_ident is not defined (the same thing you are doing with unescape_bytea).
We are shipping this patch with rubygem-activerecord-2.3.8 in the upcoming Fedora 14.
http://pkgs.fedoraproject.org/gitweb/?p=rubygem-activerecord.git;a=...
--- activerecord-2.3.8/lib/active_record/connection_adapters/postgresql_adapter.rb.orig 2010-09-08 13:41:46.000000000 -0400 +++ activerecord-2.3.8/lib/active_record/connection_adapters/postgresql_adapter.rb 2010-09-08 13:42:39.000000000 -0400 @@ -407,6 +407,9 @@ module ActiveRecord # Quotes column names for use in SQL queries. def quote_column_name(name) #:nodoc: + unless PGconn.respond_to?(:quote_ident) + raise 'Your PostgreSQL connection does not support quote_ident. Try upgrading pg.' + end PGconn.quote_ident(name.to_s) endNote this issue has been fixed in the upstream ruby-postgres project as well, whose updated version we will be shipping in Fedora 14 as well. This patch is for consistancy's sake, and in case any other postgres adapter doesn't implement this method.