Philip Warner <pjw@rhyme.com.au> writes:
> Recent testing of the BLOB restoration code of pg_dump has highlighted
> something that *may* be a problem, but I am not sure. BLOBs create tables,
> and AFAICT those tables are owned by the user who was connected at the
> time. This theoretically means that even though a user has access to a
> table with a BLOB column, they may not be able to read the BLOB - is that
> right? Should I worry about this?
The BLOB access code contains no permissions checks --- which is likely
a bug in itself, but anyway if you know the OID of a large object you
can do anything you want to it via the lo_xxx functions.
regards, tom lane