From: PG Doc comments form <noreply@postgresql.org>
To: pgsql-docs@lists.postgresql.org
Cc: robert.verhoeve@trivento.nl
Subject: Documentation bug
Date: Thu, 16 May 2019 11:20:07 +0000
Message-ID: <155800560765.1352.4307382335771280917@wrigleys.postgresql.org> (raw)
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/9.6/sql-createfunction.html
Description:
In the documentation
https://www.postgresql.org/account/comments/new/9.6/sql-createfunction.html/
(and in the same document for earlier versions) the following text is
present:
[EXTERNAL] SECURITY INVOKER
[EXTERNAL] SECURITY DEFINER
SECURITY INVOKER indicates that the function is to be executed with the
privileges of the user that calls it. That is the default. SECURITY DEFINER
specifies that the function is to be executed with the privileges of the
user that created it.
My comment is about the sentence: "SECURITY DEFINER specifies that the
function is to be executed with the privileges of the user that created
it.". In my opinion this is not quite correct as this implies that when a
function is created the privileges of that user are stored somewhere. This
is not the case. Would it make more sense to change the sentence to:
"SECURITY DEFINER specifies that the function is to be executed with the
privileges of the owner how ownes it."?
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: noreply@postgresql.org, pgsql-docs@lists.postgresql.org, robert.verhoeve@trivento.nl
Subject: Re: Documentation bug
In-Reply-To: <155800560765.1352.4307382335771280917@wrigleys.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox