From: Alexander Korotkov <akorotkov@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Add permission check for MERGE/SPLIT partition operations
Date: Sun, 12 May 2024 21:00:38 +0000
Message-ID: <E1s6GJB-000gO0-4u@gemulon.postgresql.org> (raw)
Add permission check for MERGE/SPLIT partition operations
Currently, we check only owner permission for the parent table before
MERGE/SPLIT partition operations. This leads to a security hole when users
can get access to the data of partitions without permission. This commit
fixes this problem by requiring owner permission on all the partitions
involved.
Reported-by: Alexander Lakhin
Discussion: https://postgr.es/m/0520c72e-8d97-245e-53f9-173beca2ab2e%40gmail.com
Author: Dmitry Koval, Alexander Korotkov
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/3ca43dbbb67fbfb96dec8de2e268b96790555148
Modified Files
--------------
src/backend/parser/parse_utilcmd.c | 5 ++++
src/test/regress/expected/partition_merge.out | 29 +++++++++++++++++++++++
src/test/regress/expected/partition_split.out | 29 +++++++++++++++++++++++
src/test/regress/sql/partition_merge.sql | 33 +++++++++++++++++++++++++++
src/test/regress/sql/partition_split.sql | 33 +++++++++++++++++++++++++++
5 files changed, 129 insertions(+)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: akorotkov@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add permission check for MERGE/SPLIT partition operations
In-Reply-To: <E1s6GJB-000gO0-4u@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox