Re: [patch] fix dblink security hole

Tom Lane wrote:
> Joe Conway <mail@joeconway.com> writes:
>> Tom Lane wrote:
>>> What do you think about getting rid of the password_from_string state
>>> variable?  It was always a bit of a kluge, and we don't seem to need
>>> it anymore with this approach.
> 
>> It is still used in PQconnectionUsedPassword(). That is still needed to 
>> prevent a non-superuser from logging in as the superuser if the server 
>> does not require authentication.
> 
> No, the test to see if the server actually *asked* for the password is
> the important part at that end.

Oh, I see that now. So yes, as far as I can tell, password_from_string 
is not used for anything anymore and should be removed.

Joe