From: Joe Conway <mail@joeconway.com>
To: pgsql-committers@postgresql.org
Subject: pgsql: Disallow converting a table to a view if row security is present
Date: Tue, 28 Jul 2015 23:25:17 +0000
Message-ID: <E1ZKEFJ-00009U-CF@gemulon.postgresql.org> (raw)
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-committers>
Disallow converting a table to a view if row security is present.
When DefineQueryRewrite() is about to convert a table to a view, it checks
the table for features unavailable to views. For example, it rejects tables
having triggers. It omits to reject tables having relrowsecurity or a
pg_policy record. Fix that. To faciliate the repair, invent
relation_has_policies() which indicates the presence of policies on a
relation even when row security is disabled for that relation.
Reported by Noah Misch. Patch by me, review by Stephen Frost. Back-patch
to 9.5 where RLS was introduced.
Branch
------
REL9_5_STABLE
Details
-------
http://git.postgresql.org/pg/commitdiff/344703bcc453ac3ce0060785d4958ddec7d2dbe9
Modified Files
--------------
src/backend/commands/policy.c | 29 +++++++++++++++++++++++++++++
src/backend/rewrite/rewriteDefine.c | 24 +++++++++++++++++++-----
src/include/commands/policy.h | 1 +
src/test/regress/expected/rowsecurity.out | 23 +++++++++++++++++++++++
src/test/regress/sql/rowsecurity.sql | 25 +++++++++++++++++++++++++
5 files changed, 97 insertions(+), 5 deletions(-)
--
Sent via pgsql-committers mailing list (pgsql-committers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-committers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: mail@joeconway.com
Subject: Re: pgsql: Disallow converting a table to a view if row security is present
In-Reply-To: <E1ZKEFJ-00009U-CF@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox