From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
To: Nathan Bossart <nathandbossart@gmail.com>
Cc: Alvaro Herrera <alvherre@alvh.no-ip.org>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: improving user.c error messages
Date: Thu, 16 Mar 2023 16:59:53 +0100
Message-ID: <73ab0059-a652-e44a-73c6-36f350782078@enterprisedb.com> (raw)
In-Reply-To: <20230316154858.GA791987@nathanxps13>
References: <20230127183119.e5jtyh4g2md57ctb@alvherre.pgsql>
<20230127231507.GA2221340@nathanxps13>
<20230207201009.GA450353@nathanxps13>
<e1bbef97-ed13-f6ad-8d21-b2ebc251394b@enterprisedb.com>
<20230220190210.GA3481922@nathanxps13>
<20230220225852.GA3940888@nathanxps13>
<abf97f0d-79b4-217c-2ea8-d081648d9a6d@enterprisedb.com>
<20230309175846.GA3626988@nathanxps13>
<20230310000313.GA3992372@nathanxps13>
<b0084395-5379-3872-035a-a974aa5845fb@enterprisedb.com>
<20230316154858.GA791987@nathanxps13>
On 16.03.23 16:48, Nathan Bossart wrote:
>> I think the following change in DropRole() is incorrect:
>>
>> if (!is_admin_of_role(GetUserId(), roleid))
>> ereport(ERROR,
>> (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
>> - errmsg("must have admin option on role \"%s\"",
>> - role)));
>> + errmsg("permission denied to drop role"),
>> + errdetail("Only roles with the %s attribute and the %s
>> option on role \"%s\" may drop this role.",
>> + "CREATEROLE", "ADMIN",
>> NameStr(roleform->rolname))));
>>
>> The message does not reflect what check is actually performed. (Perhaps
>> this was confused with a similar but not exactly the same check in
>> RenameRole().)
> Hm. Is your point that we should only mention the admin option here? I
> mentioned both createrole and admin option in this message (and the
> createrole check above this point) in an attempt to avoid giving partial
> information.
AFAICT, the mention of CREATEROLE is incorrect, because the code doesn't
actually check for the CREATEROLE attribute.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: peter.eisentraut@enterprisedb.com, nathandbossart@gmail.com, alvherre@alvh.no-ip.org, tgl@sss.pgh.pa.us, robertmhaas@gmail.com
Subject: Re: improving user.c error messages
In-Reply-To: <73ab0059-a652-e44a-73c6-36f350782078@enterprisedb.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox