To: christopher-piker@uiowa.edu (Chris Piker)
Cc: pgsql-sql@postgresql.org
Subject: Re: Do update permissions require select permissions 
In-reply-to: <14d07696.0311251800.7f5855b7@posting.google.com> 
References: <14d07696.0311251800.7f5855b7@posting.google.com>
Comments: In-reply-to christopher-piker@uiowa.edu (Chris Piker)
	message dated "25 Nov 2003 18:00:35 -0800"
Date: Fri, 28 Nov 2003 17:13:38 -0500
Message-ID: <1644.1070057618@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>

christopher-piker@uiowa.edu (Chris Piker) writes:
> Now as some other user one can do:
>    update data set stuff = 'other stuff';
> And it works okay.  But the following fails:
>    update data set stuff = 'yet other stuff' where id = 1;
> Why is this?  

Because the latter requires reading, not only writing, the table.

One way to look at it is that if we didn't restrict that, then a person
having only UPDATE rights could nonetheless extract information from the
table.  For example consider

	update data set stuff = stuff where id = 42;

This allows the user to determine whether id 42 exists in the table
(by noting the returned UPDATE count).  If you had not given that user
SELECT rights, presumably you don't really want him to be able to find
that out.

			regards, tom lane