From: Tom Lane <tgl@sss.pgh.pa.us>
To: cpp@world-online.no
Cc: pgsql-sql@postgresql.org
Subject: Re: Need SELECT rights to UPDATE/DELETE WHERE?
Date: Tue, 01 Feb 2005 00:34:31 -0500
Message-ID: <10344.1107236071@sss.pgh.pa.us> (raw)
In-Reply-To: <41C17A7100006F65@cpfe4.be.tisc.dk>
References: <41C17A7100006F65@cpfe4.be.tisc.dk>
cpp@world-online.no writes:
> In my hands it looks like a user with INSERT/DELETE/UPDATE rights on table1
> cannot do "update table1 set field1=xx where field2=yy" without also being
> granted select rights. However, the user can do "update table1 set field1=xx".
> Is this right?
Yes. Otherwise you can use UPDATEs to infer something about the content
of the table, eg do
update table1 set field1 = field1 where field2 = yy
and note the result count to find out whether there are any rows with
field2 = yy. If you didn't give the other guy SELECT rights then
presumably you do not want him to be able to infer any such thing.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: tgl@sss.pgh.pa.us, cpp@world-online.no
Subject: Re: Need SELECT rights to UPDATE/DELETE WHERE?
In-Reply-To: <10344.1107236071@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox