From: Tom Lane <tgl@sss.pgh.pa.us>
To: Tomasz Myrta <jasiek@klaster.net>
Cc: 'pgsql-sql@postgresql.org' <pgsql-sql@postgresql.org>
Subject: Re: function with security definer
Date: Mon, 24 Mar 2003 10:02:02 -0500
Message-ID: <12693.1048518122@sss.pgh.pa.us> (raw)
In-Reply-To: <3E7ED5EE.9090104@klaster.net>
References: <3E7ED5EE.9090104@klaster.net>
Tomasz Myrta <jasiek@klaster.net> writes:
> [ Can't do SET SESSION AUTHORIZATION in a postgres-owned function ]
That's because SET SESSION AUTHORIZATION looks to the original login
userid, not the current effective userid, to decide whether you're
allowed to do it. If it didn't work that way, a superuser couldn't
switch to any other identity after becoming a nonprivileged user.
I don't really see why you think this kluge is better than creating
multiple database users, anyway ...
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: tgl@sss.pgh.pa.us, jasiek@klaster.net
Subject: Re: function with security definer
In-Reply-To: <12693.1048518122@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox