pg.ddx.io pgsql-sql@postgresql.org mailing list archivehelp / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: christopher-piker@uiowa.edu
Cc: pgsql-sql@postgresql.org
Subject: Re: Do update permissions require select permissions
Date: Fri, 28 Nov 2003 17:13:38 -0500
Message-ID: <1644.1070057618@sss.pgh.pa.us> (raw)
In-Reply-To: <14d07696.0311251800.7f5855b7@posting.google.com>
References: <14d07696.0311251800.7f5855b7@posting.google.com>
christopher-piker@uiowa.edu (Chris Piker) writes:
> Now as some other user one can do:
> update data set stuff = 'other stuff';
> And it works okay. But the following fails:
> update data set stuff = 'yet other stuff' where id = 1;
> Why is this?
Because the latter requires reading, not only writing, the table.
One way to look at it is that if we didn't restrict that, then a person
having only UPDATE rights could nonetheless extract information from the
table. For example consider
update data set stuff = stuff where id = 42;
This allows the user to determine whether id 42 exists in the table
(by noting the returned UPDATE count). If you had not given that user
SELECT rights, presumably you don't really want him to be able to find
that out.
regards, tom lane
view thread (2+ messages)
Message-ID: <1644.1070057618@sss.pgh.pa.us> Permalink: ../1644.1070057618@sss.pgh.pa.us/ Also on: postgresql.org/message-id/1644.1070057618@sss.pgh.pa.us ·
reply
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Reply to all the recipients using the --to and --cc options: reply via email To: pgsql-sql@postgresql.org Cc: tgl@sss.pgh.pa.us, christopher-piker@uiowa.edu Subject: Re: Do update permissions require select permissions In-Reply-To: <1644.1070057618@sss.pgh.pa.us> * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox