X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org Received: from localhost (unknown [200.46.204.144]) by svr1.postgresql.org (Postfix) with ESMTP id B85928B9D00 for ; Tue, 1 Feb 2005 05:34:48 +0000 (GMT) Received: from svr1.postgresql.org ([200.46.204.71]) by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024) with ESMTP id 09864-03 for ; Tue, 1 Feb 2005 05:34:37 +0000 (GMT) Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130]) by svr1.postgresql.org (Postfix) with ESMTP id A32C58B9CA0 for ; Tue, 1 Feb 2005 05:34:37 +0000 (GMT) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.13.1/8.13.1) with ESMTP id j115YVna010345; Tue, 1 Feb 2005 00:34:31 -0500 (EST) To: cpp@world-online.no Cc: pgsql-sql@postgresql.org Subject: Re: Need SELECT rights to UPDATE/DELETE WHERE? In-reply-to: <41C17A7100006F65@cpfe4.be.tisc.dk> References: <41C17A7100006F65@cpfe4.be.tisc.dk> Comments: In-reply-to cpp@world-online.no message dated "Thu, 27 Jan 2005 16:46:25 +0100" Date: Tue, 01 Feb 2005 00:34:31 -0500 Message-ID: <10344.1107236071@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: by amavisd-new at hub.org X-Spam-Status: No, hits=0.007 tagged_above=0 required=5 tests=AWL X-Spam-Level: X-Archive-Number: 200502/16 X-Sequence-Number: 20127 cpp@world-online.no writes: > In my hands it looks like a user with INSERT/DELETE/UPDATE rights on table1 > cannot do "update table1 set field1=xx where field2=yy" without also being > granted select rights. However, the user can do "update table1 set field1=xx". > Is this right? Yes. Otherwise you can use UPDATEs to infer something about the content of the table, eg do update table1 set field1 = field1 where field2 = yy and note the result count to find out whether there are any rows with field2 = yy. If you didn't give the other guy SELECT rights then presumably you do not want him to be able to infer any such thing. regards, tom lane