pg.ddx.io pgsql-sql@postgresql.org mailing list archive
help / color / mirror / Atom feedRe: Making "SECURITY DEFINER" procedures.. - SOLVED
3+ messages / 3 participants
[nested] [flat]
* Re: Making "SECURITY DEFINER" procedures.. - SOLVED
@ 2003-04-29 23:56 Sergey Holod <sss@radiocom.net.ua>
0 siblings, 1 reply; 3+ messages in thread
From: Sergey Holod @ 2003-04-29 23:56 UTC (permalink / raw)
To: pgsql-sql; +Cc: Stephan Szabo <sszabo@megazone23.bigpanda.com>
On Wednesday 30 April 2003 02:18, you wrote:
SH> $psql -U rcbilling billing
SH> billing=> select new_session('sergey','password');
SH> NOTICE: current user is data
SH> NOTICE: after delete
SH> NOTICE: after select - 8
SH> NOTICE: after insert - KMp7ciFzJAL10Xxqft9O
SH> NOTICE: before return - KMp7ciFzJAL10Xxqft9O
SH> ERROR: data: permission denied
GRANT USAGE ON schema data TO rcbilling;
solved problem:
$ psql -U rcbilling billing
billing=> select new_session('sergey','gfhjkm');
NOTICE: current user is data
NOTICE: after delete
NOTICE: after select - 8
NOTICE: after insert - H51udQO0sxt68fA3BLMY
NOTICE: before return - H51udQO0sxt68fA3BLMY
new_session
----------------------
H51udQO0sxt68fA3BLMY
(1 row)
Don't fully undestand why I need that, but It works..
MANY THANKS for help..
--
With Best Regards,
Sergey Holod
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Making "SECURITY DEFINER" procedures.. - SOLVED
@ 2003-04-30 04:10 Tom Lane <tgl@sss.pgh.pa.us>
parent: Sergey Holod <sss@radiocom.net.ua>
0 siblings, 1 reply; 3+ messages in thread
From: Tom Lane @ 2003-04-30 04:10 UTC (permalink / raw)
To: Sergey Holod <sss@radiocom.net.ua>; +Cc: pgsql-sql@postgresql.org, Stephan Szabo <sszabo@megazone23.bigpanda.com>
Sergey Holod <sss@radiocom.net.ua> writes:
> GRANT USAGE ON schema data TO rcbilling;
> Don't fully undestand why I need that, but It works..
Okay, that's the same bug we found just a couple days ago. Schema-usage
errors are checked at query parse time, not execution time, and the
foreign-key triggers weren't being careful to set the right context for
those checks. There's a fix in place for 7.3.3.
regards, tom lane
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Making "SECURITY DEFINER" procedures.. - SOLVED
@ 2003-04-30 04:55 Stephan Szabo <sszabo@megazone23.bigpanda.com>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 3+ messages in thread
From: Stephan Szabo @ 2003-04-30 04:55 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Sergey Holod <sss@radiocom.net.ua>; pgsql-sql
On Wed, 30 Apr 2003, Tom Lane wrote:
> Sergey Holod <sss@radiocom.net.ua> writes:
> > GRANT USAGE ON schema data TO rcbilling;
> > Don't fully undestand why I need that, but It works..
>
> Okay, that's the same bug we found just a couple days ago. Schema-usage
> errors are checked at query parse time, not execution time, and the
> foreign-key triggers weren't being careful to set the right context for
> those checks. There's a fix in place for 7.3.3.
As a more general question, as what user should triggers from an action
inside a security definer function be run as? The fk triggers will work
after changing the place the permissions are changed, but afaics user
after triggers won't unless the trigger function is also security definer.
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2003-04-30 04:55 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2003-04-29 23:56 Re: Making "SECURITY DEFINER" procedures.. - SOLVED Sergey Holod <sss@radiocom.net.ua>
2003-04-30 04:10 ` Re: Making "SECURITY DEFINER" procedures.. - SOLVED Tom Lane <tgl@sss.pgh.pa.us>
2003-04-30 04:55 ` Re: Making "SECURITY DEFINER" procedures.. - SOLVED Stephan Szabo <sszabo@megazone23.bigpanda.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox