Provide the password to PostgreSQL from "dbshell" command

[Isaac Jurado]

With the PostgreSQL Django backend, if the database configuration defines a password, it is not used by the "dbshell" command. Unlike the "mysql" command, the "psql" command accepts the password through the process environment. It would be a more uniform experience if the PostgreSQL driver behaved the same.

Also note from the attached patch that "os.execvpe()" also works on Windows, so there's no need to distinguish between the two systems.

[Isaac Jurado]

Proposed fix.

[Aymeric Augustin]

Duplicate of #19893 and #7554, which was closed as wontfix, but I'm not opposed to reconsidering since the question comes up regularly.

[Loic Bistuer]

+1 for this approach, marking as accepted.

From my understanding MySQL support the MYSQL_PWD env var, wouldn't that work?

[Isaac Jurado]

The mysql command clobbers the password given in the command line, so I'm not sure if the MySQL backend needs to change it. Clobbering the process environment is also possible, just as hacky as doing it in argv, however the password length is still leaked. PostgreSQL would need a patch for that, though.

On a side note, I just realized that there's no need to copy the os.environment dictionary because the page table is going to be wiped out by os.execvp anyway.

And finally, in the MySQL backend, the use of os.system on Windows can also be removed. But that probably needs a separate patch.

[Raphaël Hertzog]

I would like to point out the discussion we just had on ​http://bugs.debian.org/781033 : namely that PGPASSWD is a deprecated feature. The correct way to handle this would be to setup a temporary password file that is then passed to the PGPASSFILE environment variable.

​http://www.postgresql.org/docs/9.0/interactive/libpq-envars.html
​https://stackoverflow.com/questions/6523019/postgresql-scripting-psql-execution-with-password

[nirgal]

I wrote a patch at ​https://github.com/django/django/pull/4392

Please review it.

[Tim Graham <timograham@…>]

In b64c0d4:

Fixed #23658 -- Provided the password to PostgreSQL dbshell command

The password from settings.py is written in a temporary .pgpass file
file whose name is given to psql using the PGPASSFILE environment
variable.

[Tim Graham <timograham@…>]

In b535eb3:

Refs #23658 -- Fixed unclosed file in dbshell tests.

[Tim Graham <timograham@…>]

In 6bd84623:

Refs #23658 -- Fixed dbshell tests on Windows.