X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org Received: from localhost (av.hub.org [200.46.204.144]) by postgresql.org (Postfix) with ESMTP id 2F1359DCC41 for ; Mon, 13 Mar 2006 10:46:16 -0400 (AST) Received: from postgresql.org ([200.46.204.71]) by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024) with ESMTP id 60129-04 for ; Mon, 13 Mar 2006 10:46:20 -0400 (AST) X-Greylist: from auto-whitelisted by SQLgrey- Received: from mx1.surnet.cl (mx1.surnet.cl [216.155.73.180]) by postgresql.org (Postfix) with ESMTP id 928F79DCC52 for ; Mon, 13 Mar 2006 10:46:13 -0400 (AST) Received: from unknown (HELO cluster.surnet.cl) ([216.155.73.165]) by mx1.surnet.cl with ESMTP; 13 Mar 2006 10:46:17 -0400 X-IronPort-AV: i="4.02,187,1139194800"; d="scan'208"; a="46088010:sNHT18129340" Received: from alvh.no-ip.org (201.221.200.21) by cluster.surnet.cl (7.0.043) (authenticated as alvherre@surnet.cl) id 43A978FD00A26787; Mon, 13 Mar 2006 10:46:17 -0400 Received: by alvh.no-ip.org (Postfix, from userid 1000) id 487CEC3A2BE; Mon, 13 Mar 2006 10:46:17 -0400 (CLT) Date: Mon, 13 Mar 2006 10:46:17 -0400 From: Alvaro Herrera To: Rod Taylor Cc: "Eugene E." , pgsql-sql@postgresql.org Subject: Re: Permission to Select Message-ID: <20060313144617.GG8274@surnet.cl> Mail-Followup-To: Rod Taylor , "Eugene E." , pgsql-sql@postgresql.org References: <441540AA.3090202@bankir.ru> <1142260392.857.49.camel@home> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1142260392.857.49.camel@home> User-Agent: Mutt/1.5.11+cvs20060126 X-Virus-Scanned: by amavisd-new at hub.org X-Spam-Status: No, score=1.561 required=5 tests=[AWL=-0.358, DNS_FROM_RFC_ABUSE=0.479, DNS_FROM_RFC_POST=1.44] X-Spam-Score: 1.561 X-Spam-Level: * X-Archive-Number: 200603/189 X-Sequence-Number: 24535 Rod Taylor wrote: > By allowing the user a where clause you grant them select privileges. > You will find that delete works the same way. > > This is one of those times when per column permissions are useful. You > could grant them select access on the "name" column but not the "salary" > column. If I understand clearly, the patch he posted modified things so that if the user issued an UPDATE command, the SELECT permission was required as well. Thus a user with UPDATE privileges but no SELECT was not allowed to execute the UPDATE command. -- Alvaro Herrera http://www.CommandPrompt.com/ PostgreSQL Replication, Consulting, Custom Development, 24x7 support