From: Antonin Houska <ah@cybertec.at>
To: "Euler Taveira" <euler@eulerto.com>
cc: "Amit Kapila" <amit.kapila16@gmail.com>,
    "Peter Eisentraut" <peter.eisentraut@enterprisedb.com>,
    "PostgreSQL Hackers" <pgsql-hackers@lists.postgresql.org>
Subject: Re: Privileges on PUBLICATION
In-reply-to: <4c420c17-8570-4b52-b7f6-9ce3f53d7ef9@www.fastmail.com>
References: <20330.1652105397@antos>
 <8a00e0e1-dc4e-422c-9dcf-664b16b18625@www.fastmail.com>
 <CAA4eK1Lya6BoMa1m8cTZrQ8KvABQpn3EsHDKRurz8UJeHsGnZw@mail.gmail.com>
 <2810.1652171844@antos>
 <d96103fe-99e2-4119-bd76-952d326b7539@www.fastmail.com>
 <5859.1652423797@antos>
 <e6025f13-fefa-4ff2-9364-24f4c77fcf7a@www.fastmail.com>
 <57022.1652867097@antos>
 <4c420c17-8570-4b52-b7f6-9ce3f53d7ef9@www.fastmail.com>
Comments: In-reply-to "Euler Taveira" <euler@eulerto.com>
   message dated "Wed, 18 May 2022 15:19:29 -0300."
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="=-=-="
Date: Mon, 20 Jun 2022 16:01:35 +0200
Message-ID: <14292.1655733695@antos.home>
Archived-At: 
 <https://www.postgresql.org/message-id/14292.1655733695%40antos.home>
Precedence: bulk

--=-=-=
Content-Type: text/plain

Euler Taveira <euler@eulerto.com> wrote:

> --eeab359ad6094efd84562cddd7fb9e89
> Content-Type: text/plain
> 
> On Wed, May 18, 2022, at 6:44 AM, Antonin Houska wrote:
> > ok, please see the next version.
> The new paragraph looks good to me. I'm not sure if the CREATE PUBLICATION is
> the right place to provide such information. As I suggested in a previous email
> [1], you could add it to "Logical Replication > Security".

ok, I missed that. The next version moves the text there.

> [1] https://postgr.es/m/d96103fe-99e2-4119-bd76-952d326b7539@www.fastmail.com

-- 
Antonin Houska
Web: https://www.cybertec-postgresql.com


--=-=-=
Content-Type: text/x-diff
Content-Disposition: attachment;
 filename=publication_filtering_warning_v3.diff

diff --git a/doc/src/sgml/logical-replication.sgml b/doc/src/sgml/logical-replication.sgml
index 145ea71d61b..2fcaa9d261a 100644
--- a/doc/src/sgml/logical-replication.sgml
+++ b/doc/src/sgml/logical-replication.sgml
@@ -1171,6 +1171,17 @@ CONTEXT:  processing remote data for replication origin "pg_16395" during "INSER
    schema automatically, the user must be a superuser.
   </para>
 
+  <para>
+   Note that there are currently no privileges on publication, and that any
+   subscriber can access any publication. Thus if you're trying to hide some
+   information from particular subscribers (by using the
+   <literal>WHERE</literal> clause or the column list, or by not adding the
+   whole table to the publication), please be aware that other publications
+   can expose the same information. Publication privileges might be added
+   to <productname>PostgreSQL</productname> in the future to allow for
+   fine-grained access control.
+  </para>
+
   <para>
    To create a subscription, the user must be a superuser.
   </para>

--=-=-=--