From: Tom Lane <tgl@sss.pgh.pa.us>
To: Aasmund Midttun Godal <postgresql@aasmund.com>
Cc: pgsql-sql@postgresql.org
Subject: Re: Before/After Trigger User Switching
Date: Wed, 20 Aug 2003 16:53:22 -0400
Message-ID: <19303.1061412802@sss.pgh.pa.us> (raw)
In-Reply-To: <20030820203343.8271.qmail@one.kreator.com>
References: <20030820171250.15333.qmail@one.kreator.com>
<17711.1061410347@sss.pgh.pa.us>
<20030820203343.8271.qmail@one.kreator.com>
"Aasmund Midttun Godal" <postgresql@aasmund.com> writes:
> Thank you for your quick reply!
> I understand your point of view, however the fact remains that you want the
> action to be done as though it was the DEFINER user that did it, and that
> has not changed even thoug the function itself has finished?
<shrug> ... if there's any bug here, I'd argue that it's that we don't
force trigger functions to run as the owner of the table they're on.
The privileges of the user that did the INSERT or whatever are the wrong
thing in any case, I'd say.
Which suggests a workaround for the moment: your trigger function should
be a SECURITY DEFINER.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: tgl@sss.pgh.pa.us, postgresql@aasmund.com
Subject: Re: Before/After Trigger User Switching
In-Reply-To: <19303.1061412802@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox