From: Antonin Houska <ah@cybertec.at>
To: Euler Taveira <euler@eulerto.com>
Cc: Amit Kapila <amit.kapila16@gmail.com>
Cc: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Privileges on PUBLICATION
Date: Mon, 20 Jun 2022 16:01:35 +0200
Message-ID: <14292.1655733695@antos.home> (raw)
In-Reply-To: <4c420c17-8570-4b52-b7f6-9ce3f53d7ef9@www.fastmail.com>
References: <20330.1652105397@antos>
<8a00e0e1-dc4e-422c-9dcf-664b16b18625@www.fastmail.com>
<CAA4eK1Lya6BoMa1m8cTZrQ8KvABQpn3EsHDKRurz8UJeHsGnZw@mail.gmail.com>
<2810.1652171844@antos>
<d96103fe-99e2-4119-bd76-952d326b7539@www.fastmail.com>
<5859.1652423797@antos>
<e6025f13-fefa-4ff2-9364-24f4c77fcf7a@www.fastmail.com>
<57022.1652867097@antos>
<4c420c17-8570-4b52-b7f6-9ce3f53d7ef9@www.fastmail.com>
Euler Taveira <euler@eulerto.com> wrote:
> --eeab359ad6094efd84562cddd7fb9e89
> Content-Type: text/plain
>
> On Wed, May 18, 2022, at 6:44 AM, Antonin Houska wrote:
> > ok, please see the next version.
> The new paragraph looks good to me. I'm not sure if the CREATE PUBLICATION is
> the right place to provide such information. As I suggested in a previous email
> [1], you could add it to "Logical Replication > Security".
ok, I missed that. The next version moves the text there.
> [1] https://postgr.es/m/d96103fe-99e2-4119-bd76-952d326b7539@www.fastmail.com
--
Antonin Houska
Web: https://www.cybertec-postgresql.comAttachments:
[text/x-diff] publication_filtering_warning_v3.diff (1.0K, ../14292.1655733695@antos.home/2-publication_filtering_warning_v3.diff)
download | inline diff:diff --git a/doc/src/sgml/logical-replication.sgml b/doc/src/sgml/logical-replication.sgmlindex 145ea71d61b..2fcaa9d261a 100644--- a/doc/src/sgml/logical-replication.sgml+++ b/doc/src/sgml/logical-replication.sgml@@ -1171,6 +1171,17 @@ CONTEXT: processing remote data for replication origin "pg_16395" during "INSER
schema automatically, the user must be a superuser.
</para>
+ <para>+ Note that there are currently no privileges on publication, and that any+ subscriber can access any publication. Thus if you're trying to hide some+ information from particular subscribers (by using the+ <literal>WHERE</literal> clause or the column list, or by not adding the+ whole table to the publication), please be aware that other publications+ can expose the same information. Publication privileges might be added+ to <productname>PostgreSQL</productname> in the future to allow for+ fine-grained access control.+ </para>+
<para>
To create a subscription, the user must be a superuser.
</para>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: ah@cybertec.at, euler@eulerto.com, amit.kapila16@gmail.com, peter.eisentraut@enterprisedb.com, pgsql-hackers@lists.postgresql.org
Subject: Re: Privileges on PUBLICATION
In-Reply-To: <14292.1655733695@antos.home>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox