Subject: Re: User with BYPASSRLS privilege can't change password
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Stephen Frost <sfrost@snowman.net>, pgsql-bugs@lists.postgresql.org
References: <a5548a9f-89ee-3167-129d-162b5985fcf8@technowledgy.de>
 <923005.1604420579@sss.pgh.pa.us> <956994.1604425451@sss.pgh.pa.us>
 <3e771893-1ed1-97e7-6c4a-7b0d00992103@technowledgy.de>
 <958492.1604427541@sss.pgh.pa.us>
From: Wolfgang Walther <walther@technowledgy.de>
Message-ID: <be39bd26-4024-0bf5-eb28-31984a887265@technowledgy.de>
Date: Tue, 3 Nov 2020 19:26:13 +0100
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.12.1
MIME-Version: 1.0
In-Reply-To: <958492.1604427541@sss.pgh.pa.us>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

Tom Lane:
> How do you figure that?  This is in an "else" path after
> 
> 	else if (authform->rolreplication || isreplication >= 0)
> 
> so AFAICS it's impossible to get there.  If it isn't impossible,
> we have a much bigger hole with respect to issuper.

Yes, you're right. I read the || as &&. And also missed the ! in else if 
(!have_createrole_privilege()) btw. :)

I guess the error message "must be superuser to alter replication users" 
led me on the wrong path. I would be more precise as "must be superuser 
to alter replication users or change replication attribute" to cover the 
change-non-replication-to-replication user case, I think. The same thing 
for superusers.

Best

Wolfgang