Index: src/interfaces/libpq/fe-connect.c
===================================================================
RCS file: /projects/cvsroot/pgsql-server/src/interfaces/libpq/fe-connect.c,v
retrieving revision 1.197
diff -c -r1.197 fe-connect.c
*** src/interfaces/libpq/fe-connect.c	2002/08/27 16:21:51	1.197
--- src/interfaces/libpq/fe-connect.c	2002/08/29 02:02:58
***************
*** 16,25 ****
--- 16,27 ----
  #include "postgres_fe.h"
  
  #include <sys/types.h>
+ #include <sys/stat.h>
  #include <fcntl.h>
  #include <errno.h>
  #include <ctype.h>
  #include <time.h>
+ #include <unistd.h>
  
  #include "libpq-fe.h"
  #include "libpq-int.h"
***************
*** 2927,2932 ****
--- 2929,2935 ----
  	FILE   *fp;
  #define LINELEN NAMEDATALEN*5
  	char	buf[LINELEN];
+ 	struct stat stat_buf;
  
  	if (pwdfile == NULL || strcmp(pwdfile, "") == 0)
  		return NULL;
***************
*** 2942,2947 ****
--- 2945,2963 ----
  
  	if (port == NULL)
  		port = DEF_PGPORT_STR;
+ 
+ 	/* If password file cannot be opened, ignore it. */
+ 	if (stat(pwdfile, &stat_buf) == -1)
+ 		return NULL;
+ 
+ 	/* If password file is insecure, alert the user and ignore it. */
+ 	if (stat_buf.st_mode & (S_IRWXG | S_IRWXO))
+ 	{
+ 		fprintf(stderr,
+ 				libpq_gettext("WARNING: Password file %s has world or group read access; permission should be u=rw (0600)"),
+ 				pwdfile);
+ 		return NULL;
+ 	}
  
  	fp = fopen(pwdfile, "r");
  	if (fp == NULL)