pghero 4.0.1 → 4.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a4cfe44cedeb0150487120c8cb8ffa17b319fe1950a0140cfab35b64e00a52b
-  data.tar.gz: ae1b6e6380230a166ccce42f9da6143364bf4ab58f041de2944e1a80dfc2f403
+  metadata.gz: 3acbc4629f0e8c8b468669dbcbeeb01ef5e8b3827f891772412a19d92d1c3b76
+  data.tar.gz: d9f2f710437de7b76e0d6757be81c36ca68f2469ee9c44ec751972a55d00e20f
 SHA512:
-  metadata.gz: d951a347d8018e5a04aafc24bf724774c6882e88e6b084756eda02d30b49c9cdea013b223c17c401dbe5d342f42b18687c1d332ac982e766efae5296ca4de359
-  data.tar.gz: 2d20b1f83a9d7d13e38f632f8f30d8c69c83a1e4d82351d51e3b8351dc0fc53bcad10202c9a7c88532457deeec8fa30bfef7dfc8b9c95f6d6311e87350593f98
+  metadata.gz: eecc0a4dce22f7203e7f18928ea9537cb35e4f9b7814ed68cf216b669795bfaa85ec33bd31b94e86c523564d1965058d19fed919471e3882cccd6762be6c7a15
+  data.tar.gz: 64d275ba685349df7be06a829927f5a711a36c33afffc4af43bc3bb916b819b3978e0f51fa01c7085d57406dc9fff7aeadd8796c2d772c2c38790259879a87b1

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 4.1.0 (2026-10-20)
+
+- Restricted killing queries to current database and certain backend types - [more info](https://github.com/ankane/pghero/security/advisories/GHSA-5287-hmjh-qmqq)
+- Added grouping for parallel queries
+- Fixed error when index is dropped during indexes query
+- Fixed `unable to filter data` messages
+- Removed replication backend types from live queries page
+
 ## 4.0.1 (2026-08-15)
 
 - Added sequences from identity columns

data/app/controllers/pg_hero/home_controller.rb

@@ -36,8 +36,7 @@ module PgHero
         @inactive_replication_slots = @database.replication_slots.select { |r| !r[:active] }
       end
 
-      @walsender_queries, long_running_queries = @database.long_running_queries.partition { |q| q[:backend_type] == "walsender" }
-      @autovacuum_queries, @long_running_queries = long_running_queries.partition { |q| q[:query].starts_with?("autovacuum:") }
+      @autovacuum_queries, @long_running_queries = @database.long_running_queries.partition { |q| q[:backend_type] == "autovacuum worker" }
 
       connection_states = @database.connection_states
       @total_connections = connection_states.values.sum
@@ -416,21 +415,27 @@ module PgHero
     end
 
     def kill
-      if @database.kill(params[:pid])
+      if @database.kill(params[:pid], key: params[:key].to_i)
         redirect_backward notice: "Query killed"
       else
         redirect_backward notice: "Query no longer running"
       end
+    rescue ActiveRecord::StatementInvalid
+      redirect_backward alert: "The database user does not have permission to kill this query"
     end
 
     def kill_long_running_queries
       @database.kill_long_running_queries
       redirect_backward notice: "Queries killed"
+    rescue ActiveRecord::StatementInvalid
+      redirect_backward alert: "The database user does not have permission to kill some queries"
     end
 
     def kill_all
       @database.kill_all
       redirect_backward notice: "Connections killed"
+    rescue ActiveRecord::StatementInvalid
+      redirect_backward alert: "The database user does not have permission to kill some connections"
     end
 
     def enable_query_stats
@@ -528,7 +533,7 @@ module PgHero
     end
 
     def group_connections_by_key(connections, key)
-      group_connections(connections, [key]).map { |v| [v[key], v[:total_connections]] }.to_h
+      group_connections(connections, [key]).to_h { |v| [v[key], v[:total_connections]] }
     end
 
     def check_api

data/app/views/pg_hero/home/_live_queries_table.html.erb

@@ -10,7 +10,7 @@
   <tbody>
     <% queries.reverse.each do |query| %>
       <tr>
-        <td><%= query[:pid] %></td>
+        <td><%= ([query[:pid]] + query[:worker_pids]).join(", ") %></td>
         <td>
           <% if query[:duration_ms] %>
             <% sec = query[:duration_ms] / 1000.0 %>
@@ -32,11 +32,11 @@
           <% end %>
         </td>
         <td class="text-right">
-          <% unless @database.filter_data %>
+          <% if @explain_enabled && (!@database.filter_data || @database.server_version_num >= 160000) %>
             <%= button_to "Explain", explain_path, params: {query: query[:query]}, form: {target: "_blank"}, class: "btn btn-info" %>
           <% end %>
-          <% if @kill_enabled %>
-            <%= button_to "Kill", kill_path(pid: query[:pid]), class: "btn btn-danger" %>
+          <% if @kill_enabled && ["client backend", "autovacuum worker"].include?(query[:backend_type]) %>
+            <%= button_to "Kill", kill_path(pid: query[:pid], key: query[:started_at].usec), class: "btn btn-danger" %>
           <% end %>
         </td>
       </tr>

data/app/views/pg_hero/home/_queries_table.html.erb

@@ -46,7 +46,7 @@
           <span class="user">
             <% if query[:user] %>
               <%= @link_user ? link_to(query[:user], {user: query[:user]}.merge(@link_options)) : query[:user] %>
-              <% if @show_details %>
+              <% if @show_details && query[:query_hash] %>
                 &middot;
               <% end %>
             <% end %>
@@ -61,7 +61,7 @@
         <td colspan="3" class="query-row">
           <pre><code class="query-code language-pgsql"><%= query[:query] %></code></pre>
           <% if query[:query] == "<insufficient privilege>" %>
-            <p class="text-muted">For security reasons, only superusers can see queries executed by other users.</p>
+            <p class="text-muted">Add the <code>pg_read_all_stats</code> role to see queries executed by other users.</p>
           <% end %>
           <% if local_assigns[:suggested_indexes] != false && (details = @suggested_indexes_by_query[query[:query]]) && (details[:index] || @debug) %>
             <%= render partial: "suggested_index", locals: {index: details[:index], details: details} %>

data/app/views/pg_hero/home/index.html.erb

@@ -26,9 +26,6 @@
     <% if @autovacuum_queries.any? %>
       <span class="tiny"><%= @autovacuum_queries.size %> autovacuum</span>
     <% end %>
-    <% if @walsender_queries.any? %>
-      <span class="tiny"><%= @walsender_queries.size %> walsender</span>
-    <% end %>
   </div>
   <% if @extended %>
     <div class="alert alert-<%= @good_cache_rate ? "success" : "warning" %>">
@@ -68,7 +65,7 @@
     <% end %>
   </div>
   <div class="alert alert-<%= @invalid_indexes.empty? && @invalid_constraints.empty? ? "success" : "warning" %>">
-    <% if @invalid_indexes.empty? && @invalid_constraints.empty?  %>
+    <% if @invalid_indexes.empty? && @invalid_constraints.empty? %>
       No invalid indexes or constraints
     <% else %>
       <% if @invalid_indexes.any? %>

data/config/routes.rb

@@ -1,5 +1,5 @@
 PgHero::Engine.routes.draw do
-  scope "(:database)", constraints: proc { |req| (PgHero.config["databases"].keys + [nil]).include?(req.params[:database]) } do
+  scope "(:database)", constraints: PgHero::DatabaseConstraint.new do
     get "space", to: "home#space"
     get "space/:relation", to: "home#relation_space", as: :relation_space
     get "index_bloat", to: "home#index_bloat"

data/lib/pghero/database.rb

@@ -98,7 +98,7 @@ module PgHero
           if config.key?("filter_data")
             config["filter_data"]
           elsif PgHero.config.key?("filter_data")
-            PgHero.config.key?("filter_data")
+            PgHero.config["filter_data"]
           else
             PgHero.filter_data
           end

data/lib/pghero/engine.rb

@@ -14,4 +14,11 @@ module PgHero
       PgHero.time_zone = file_config["time_zone"] if file_config["time_zone"]
     end
   end
+
+  class DatabaseConstraint
+    def matches?(request)
+      database = request.params[:database]
+      database.nil? || PgHero.config["databases"].key?(database)
+    end
+  end
 end

data/lib/pghero/methods/basic.rb

@@ -66,8 +66,20 @@ module PgHero
           if filter_data
             query_columns.each do |column|
               result.each do |row|
+                value = row[column]
+                if value.nil? || value == "<insufficient privilege>"
+                  next
+                end
+
+                if value.start_with?("autovacuum:")
+                  prefix = "autovacuum:"
+                  value = value.delete_prefix("autovacuum:")
+                else
+                  prefix = ""
+                end
+
                 begin
-                  row[column] = PgQuery.normalize(row[column]) unless row[column].nil?
+                  row[column] = prefix + PgQuery.normalize(value)
                 rescue PgQuery::ParseError
                   # try replacing "interval $1" with "$1::interval"
                   # see https://github.com/lfittl/pg_query/issues/169 for more info
@@ -75,7 +87,7 @@ module PgHero
                   # we could skip normalization
                   # but this has a very small chance of data leakage
                   begin
-                    row[column] = PgQuery.normalize(row[column].gsub(/\binterval\s+(\$\d+)\b/i, "\\1::interval"))
+                    row[column] = prefix + PgQuery.normalize(value.gsub(/\binterval\s+(\$\d+)\b/i, "\\1::interval"))
                   rescue PgQuery::ParseError
                     row[column] = "<unable to filter data>"
                   end

data/lib/pghero/methods/indexes.rb

@@ -154,7 +154,7 @@ module PgHero
           ORDER BY
             1, 2
         SQL
-        ).map { |v| v[:columns] = v[:columns].sub(") WHERE (", " WHERE ").split(", ").map { |c| unquote(c) }; v }
+        ).select { |v| v[:definition] }.map { |v| v[:columns] = v[:columns].sub(") WHERE (", " WHERE ").split(", ").map { |c| unquote(c) }; v }
 
         # determine if any invalid indexes being created
         # hacky, but works for simple cases
@@ -322,7 +322,7 @@ module PgHero
             wastedbytes DESC,
             index_name
         SQL
-        select_all(sql, {min_size: min_size.to_i})
+        select_all(sql, {min_size: min_size.to_i}).select { |v| v[:definition] }
       end
 
       protected

data/lib/pghero/methods/kill.rb

@@ -2,29 +2,51 @@ module PgHero
   module Methods
     module Kill
       # note: this method is not affected by disable_kill option
-      def kill(pid)
-        select_one("SELECT pg_terminate_backend(:pid)", {pid: pid.to_i})
+      def kill(pid, key: nil)
+        kill_backends(pid: pid, key: key, backend_type: ["client backend", "autovacuum worker"]).any? { |v| v[:pg_terminate_backend] }
       end
 
       # note: this method is not affected by disable_kill option
       def kill_long_running_queries(min_duration: nil)
-        running_queries(min_duration: min_duration || long_running_query_sec).each { |query| kill(query[:pid]) }
+        kill_backends(min_duration: min_duration || long_running_query_sec)
         true
       end
 
       # note: this method is not affected by disable_kill option
       def kill_all
-        select_all <<~SQL
+        kill_backends
+        true
+      end
+
+      private
+
+      def kill_backends(pid: nil, key: nil, min_duration: nil, backend_type: ["client backend"])
+        select_expr = "pg_terminate_backend(pid)"
+        # key is used to reduce chance of killing different query
+        # check *after* row matches other conditions
+        if key
+          select_expr = "CASE WHEN EXTRACT(MICROSECONDS FROM COALESCE(query_start, xact_start)) % 1000000 = :key THEN #{select_expr} ELSE NULL END AS pg_terminate_backend"
+        end
+        query = <<~SQL
           SELECT
-            pg_terminate_backend(pid)
+            #{select_expr}
           FROM
             pg_stat_activity
           WHERE
             pid <> pg_backend_pid()
             AND query <> '<insufficient privilege>'
             AND datname = current_database()
+            AND backend_type IN (:backend_type)
+            #{"AND pid = :pid" if pid}
+            #{"AND state <> 'idle' AND NOW() - COALESCE(query_start, xact_start) > interval :min_duration" if min_duration}
         SQL
-        true
+
+        binds = {}
+        binds[:backend_type] = Array(backend_type)
+        binds[:pid] = pid.to_i if pid
+        binds[:key] = key.to_i if key
+        binds[:min_duration] = "#{min_duration.to_i} seconds" if min_duration
+        select_all(query, binds)
       end
     end
   end

data/lib/pghero/methods/queries.rb

@@ -5,6 +5,7 @@ module PgHero
         query = <<~SQL
           SELECT
             pid,
+            leader_pid,
             state,
             application_name AS source,
             age(NOW(), COALESCE(query_start, xact_start)) AS duration,
@@ -20,6 +21,7 @@ module PgHero
             state <> 'idle'
             AND pid <> pg_backend_pid()
             AND datname = current_database()
+            AND backend_type IN ('client backend', 'parallel worker', 'autovacuum worker')
             #{"AND NOW() - COALESCE(query_start, xact_start) > interval :min_duration" if min_duration}
             #{"AND query <> '<insufficient privilege>'" if !all}
           ORDER BY
@@ -28,7 +30,14 @@ module PgHero
 
         binds = {}
         binds[:min_duration] = "#{min_duration.to_i} seconds" if min_duration
-        select_all(query, binds, query_columns: [:query])
+        queries = select_all(query, binds, query_columns: [:query])
+        groups = queries.group_by { |v| v[:leader_pid] || v[:pid] }
+        groups.map do |pid, queries|
+          leader = queries.find { |v| v[:leader_pid].nil? } || queries.first
+          leader.delete(:leader_pid)
+          leader[:worker_pids] = queries.filter_map { |v| v[:pid] if v.key?(:leader_pid) }
+          leader
+        end
       end
 
       def long_running_queries
@@ -67,10 +76,10 @@ module PgHero
             NOT blockedl.granted
             AND blockeda.query <> '<insufficient privilege>'
             AND blockeda.datname = current_database()
+            AND blockeda.backend_type IN ('client backend', 'parallel worker', 'autovacuum worker')
           ORDER BY
             blocked_duration DESC
         SQL
-
         select_all(query, query_columns: [:blocked_query, :current_or_recent_query_in_blocking_process])
       end
     end

data/lib/pghero/methods/space.rb

@@ -93,7 +93,7 @@ module PgHero
       def relation_space_stats(relation, schema: "public")
         if space_stats_enabled?
           relation_sizes ||= self.relation_sizes
-          sizes = relation_sizes.map { |r| [[r[:schema], r[:relation]], r[:size_bytes]] }.to_h
+          sizes = relation_sizes.to_h { |r| [[r[:schema], r[:relation]], r[:size_bytes]] }
           start_at = 30.days.ago
 
           sql = <<~SQL

data/lib/pghero/methods/suggested_indexes.rb

@@ -198,6 +198,7 @@ module PgHero
       def best_index_structure(statement)
         return {error: "Empty statement"} if statement.to_s.empty?
         return {error: "Too large"} if statement.to_s.length > 10000
+        return {error: "Insufficient privilege"} if statement == "<insufficient privilege>"
 
         begin
           tree = PgQuery.parse(statement).tree

data/lib/pghero/version.rb

@@ -1,3 +1,3 @@
 module PgHero
-  VERSION = "4.0.1"
+  VERSION = "4.1.0"
 end

data/lib/pghero.rb

@@ -83,7 +83,7 @@ module PgHero
 
     # private
     def explain_mode
-      @config["explain"]
+      config["explain"]
     end
 
     def visualize_url
@@ -163,7 +163,7 @@ module PgHero
           # return if another process initialized while we were waiting
           return @databases if defined?(@databases)
 
-          @databases = config["databases"].map { |id, c| [id.to_sym, Database.new(id, c)] }.to_h
+          @databases = config["databases"].to_h { |id, c| [id.to_sym, Database.new(id, c)] }
         end
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pghero
 version: !ruby/object:Gem::Version
-  version: 4.0.1
+  version: 4.1.0
 platform: ruby
 authors:
 - Andrew Kane
@@ -121,7 +121,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 4.0.20
 specification_version: 4
 summary: A performance dashboard for Postgres
 test_files: []