doc: Granting TRIGGER or REFERENCES on table is dangerous.

It's always been the case that granting these privileges to users that
you don't fully trust was a bad idea, but it hasn't always been
obvious to people reading the documentation that this is the case.
To prevent confusion, and also repeated reports to pgsql-security,
mention it explicitly.

Discussion: http://postgr.es/m/CA+TgmobrjCHBuWHrvX3=2vndUCO2thUOdevrCcMDFW86cqCYvw@mail.gmail.com
Reviewed-by: Nathan Bossart <nathandbossart@gmail.com>
Backpatch-through: 14

diff --git a/doc/src/sgml/ddl.sgml b/doc/src/sgml/ddl.sgml
index 0fcdabd7877fc8600d1aa6d058309a1cf7b0cccd..5e8c270ab3a8553ca6a5234fbba6ef5d6940a1dd 100644 (file)
--- a/doc/src/sgml/ddl.sgml
+++ b/doc/src/sgml/ddl.sgml
@@ -2396,7 +2396,11 @@ REVOKE ALL ON accounts FROM PUBLIC;
      <listitem>
       <para>
        Allows creation of a foreign key constraint referencing a
-       table, or specific column(s) of a table.
+       table, or specific column(s) of a table. Great care should be taken when
+       granting this privilege, since a user who creates a foreign key can arrange
+       for enforcement of that foreign key to call an arbitrary function, such as
+       a cast function, and such functions will be called with the privileges of
+       the table owner.
       </para>
      </listitem>
     </varlistentry>
@@ -2405,7 +2409,9 @@ REVOKE ALL ON accounts FROM PUBLIC;
      <term><literal>TRIGGER</literal></term>
      <listitem>
       <para>
-       Allows creation of a trigger on a table, view, etc.
+       Allows creation of a trigger on a table, view, etc. Great care should be
+       taken when granting this privilege, since any triggers added to a table
+       or view will be executed with the privileges of users who modify it.
       </para>
      </listitem>
     </varlistentry>