pgAdmin 4 in server mode had no data isolation between users — any
authenticated user could access other users' private servers,
background processes, and debugger state by guessing object IDs.
The shared server feature had 21 vulnerabilities including credential
leaks, privilege escalation via passexec_cmd, and owner data
corruption via SQLAlchemy session mutations.
Centralized access control:
- New server_access.py with get_server(), get_server_group(),
get_user_server_query() replacing ~20 unfiltered queries
- connection_manager() raises ObjectGone (HTTP 410) in server mode
when access is denied — fixes 155+ unguarded callers
- UserScopedMixin.for_user() on 10 models replaces scattered
user_id filters
Shared server isolation (all 21 audit issues):
- Expunge server from session before property merge to prevent
owner data corruption
- Suppress passexec_cmd, post_connection_sql for non-owners in
merge, API response, and ServerManager
- Override all 6 SSL/passfile connection_params keys from
SharedServer; strip owner-only keys; sanitize on creation
- _is_non_owner() helper centralises 15+ inline ownership checks
- SharedServer lookup uses (osid, user_id) not name
- Unique constraint on SharedServer(osid, user_id)
- Tunnel/DB password save, change_password, clear_saved_password,
clear_sshtunnel_password all branch on ownership
- Only owner can unshare (delete_shared_server guard)
- Session restore includes shared servers
- tunnel_port/tunnel_keep_alive copied from owner, not hardcoded
Tool/module hardening:
- All tool endpoints use get_server()
- Debugger function arguments scoped by user_id
- Background processes use Process.for_user()
- Workspace adhoc servers scoped to current user
Migration (schema version 49 -> 50):
- Add user_id to debugger_function_arguments composite PK
- Add indexes on server, sharedserver, servergroup
- Add unique constraint on sharedserver(osid, user_id)
* Add preference for insert with relations
Co-authored-by: Christian P. <pirnichristian@gmail.com>
* Insert tables with relations on drag and drop
Co-authored-by: Christian P. <pirnichristian@gmail.com>
* Fix test mock not returning Erd Supported Data
Co-authored-by: Christian P. <pirnichristian@gmail.com>
---------
Co-authored-by: Christian P. <pirnichristian@gmail.com>
1. Migration failed on Debian 11.
2. Menu shortcuts should not for opening search object and query tool when not in default workspace.
Co-authored-by: Yogesh Mahajan <yogesh.mahajan@enterprisedb.com>
Co-authored-by: Pravesh Sharma <pravesh.sharma@enterprisedb.com>
1. Preserve updated tab titles on session restore
2. Ensure query tools opened via the 'Generate Script' are editable.
3. On restore, ensure the query content is correctly loaded into the query tool when it is opened from tools like ERD.
1. Leverage rc-dock layout to restore the application state.
2. Move the save and load file endpoints to the file manager module.
3. Ensure that the order and layout of tabs is maintained on restore.
4. Persist the changed title of tabs on restore.
Fixed an issue in ERD where link notation end-points were not rendering occasionally.
---------
Co-authored-by: Aditya Toshniwal <aditya.toshniwal@enterprisedb.com>
1) Do not use the Array index in keys.
2) Import from the same module should be merged.
3) Mutable variables should not be exported.
4) Variables should not be initialized to undefined.
5) startswith or endswith method should be used.
6) Unwrap this unnecessarily grouped subpattern.
Additionally, addressed many other SonarQube rules.
1) String literals should not be duplicated.
2) Prefer using an optional chain expression instead, as it's more concise and easier to read.
3) Expected the Promise rejection reason to be an Error.
Ashesh Vashi
Lance J.
Pravesh Sharma
Akshay Joshi
Dave Page
Aditya Toshniwal
Yogesh Mahajan
Rohit Bhati
Khushboo Vashi
Anil Sahoo