postgres.git / summary / log / commit / refs

commit    84387fc889442bd92b5969aa314b85cff360c7fe
Author:   Peter Eisentraut <peter@eisentraut.org>
Date:     Tue Nov 01 13:18:37 2022 +0000

    doc: Add note about lack of publication privileges
    
    This gives some additional advice on using row filters and column
    lists on publications securely.
    
    Author: Antonin Houska <ah@cybertec.at>
    Reviewed-by: Euler Taveira <euler@eulerto.com>
    Discussion: https://www.postgresql.org/message-id/flat/20330.1652105397@antos


 doc/src/sgml/logical-replication.sgml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/doc/src/sgml/logical-replication.sgml b/doc/src/sgml/logical-replication.sgml
index e98538e5400..434bc311805 100644
--- a/doc/src/sgml/logical-replication.sgml
+++ b/doc/src/sgml/logical-replication.sgml
@@ -1570,6 +1570,17 @@ CONTEXT:  processing remote data for replication origin "pg_16395" during "INSER
    schema automatically, the user must be a superuser.
   </para>
 
+  <para>
+   There are currently no privileges on publications.  Any subscription (that
+   is able to connect) can access any publication.  Thus, if you intend to
+   hide some information from particular subscribers, such as by using row
+   filters or column lists, or by not adding the whole table to the
+   publication, be aware that other publications in the same database could
+   expose the same information.  Publication privileges might be added to
+   <productname>PostgreSQL</productname> in the future to allow for
+   finer-grained access control.
+  </para>
+
   <para>
    To create a subscription, the user must be a superuser.
   </para>


[parent: 2ea5de296ef2]