It has come to our attention that the PostGIS Raster support may give more privileges to users than an administrator is willing to grant. These include reading files from the filesystem and opening connections to network hosts.
Both issues can be limited in existing installations by setting the GDAL_SKIP variable (in the PostgreSQL server environment) to the list of all gdal drivers, but some drivers would still be forceably loaded by some operations.
Releases 2.1.3 and 2.0.6 strengthen the code to load no drivers by default and allows for a fine-grained tuning of what’s allowed and what not through postgis-specific environment variables:
Specifies a list of GDAL drivers to enable (rather than skip) By default all drivers are disabled. Example value: “GTiff PNG JPEG”
Enables read support for out-db raster bands if set to 1. By default out-db raster bands reading is disabled.
Upgrade is highly recommended, especially for online services allowing users to run arbitrary SQL queries.
Special thanks to Even Rouault for bringing up the issue and giving advice on its resolution.
The PostGIS Team is pleased to release the release of PostGIS 3.1.1!
This release is a bug fix release, addressing issues found in the previous 3.1 release.
The PostGIS Team is pleased to release the release of PostGIS 3.1.0!
This version exposes the new features of GEOS 3.9 as well as numerous core performance enhancements for spatial joins, large object access, text format output and more.
The k-means clustering code has been enhanced to support weighting and higher dimensional clusters.
Geometry generators to create hexagonal and square tilings have been added, for simpler in-the-database summarization queries.
Finally, PostGIS exposes the latest enhancements in the GEOS geometry library 3.9 version. The new overlay engine (aka “OverlayNG”) provides more robust handling of difficult input geometries, using a set of new noding strategies to process geometry. For the end user, this should mean no more “topology exceptions” when using the union, difference, intersection or symmetric difference functions. PostGIS also exposes the new fixed precision overlay capability via an additional grid-size parameter on ST_Intersection and the other overlay functions.
The PostGIS Team is pleased to release the release candidate of the upcoming PostGIS 3.1.0 release. This version is exposes some of the new performance and feature enhancements in GEOS 3.9 as well as numerous speed enhancements not requiring newer GEOS.
Best served with: