From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
cc: Antonin Houska <ah@cybertec.at>,
        PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: Incorrect comment on pg_shadow view
In-reply-to: <F1EF4F30-691E-40F5-B5FE-B9C837511412@yesql.se>
References: <31926.1729252247@antos> <F1EF4F30-691E-40F5-B5FE-B9C837511412@yesql.se>
Comments: In-reply-to Daniel Gustafsson <daniel@yesql.se>
	message dated "Fri, 18 Oct 2024 14:09:43 +0200"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <868677.1729261352.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Fri, 18 Oct 2024 10:22:32 -0400
Message-ID: <868678.1729261352@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/868678.1729261352%40sss.pgh.pa.us>
Precedence: bulk

Daniel Gustafsson <daniel@yesql.se> writes:
>> On 18 Oct 2024, at 13:50, Antonin Houska <ah@cybertec.at> wrote:
>> Attached is a proposal to fix a comment in pg_authid.h. pg_shadow is no=
t (and
>> obviously should not be) accessible by public:

> - *	  pg_shadow and pg_group are now publicly accessible views on pg_aut=
hid.
> + *	  pg_shadow and pg_group are now views on pg_authid.

> I'm no native speaker but I don't interpret "publicly accessible" as rea=
dable
> by the public role, rather that they are accessible via a user interface=
 (in
> this case SQL).

I think Antonin is right.  pg_authid is just as accessible from SQL as
these views are.  Also note the phrasing in the SGML documentation of
pg_shadow [1]:

    The name stems from the fact that this table should not be
    readable by the public since it contains passwords. pg_user is a
    publicly readable view on pg_shadow that blanks out the password
    field.

			regards, tom lane

[1] https://www.postgresql.org/docs/devel/view-pg-shadow.html