pg.ddx.io pgsql-sql@postgresql.org mailing list archive
help / color / mirror / Atom feedNeed SELECT rights to UPDATE/DELETE WHERE?
2+ messages / 2 participants
[nested] [flat]
* Need SELECT rights to UPDATE/DELETE WHERE?
@ 2005-01-27 15:46 cpp@world-online.no
0 siblings, 1 reply; 2+ messages in thread
From: cpp@world-online.no @ 2005-01-27 15:46 UTC (permalink / raw)
To: pgsql-sql
PostgreSQL 8.0.0 on WinXP Pro, libpq
In my hands it looks like a user with INSERT/DELETE/UPDATE rights on table1
cannot do "update table1 set field1=xx where field2=yy" without also being
granted select rights. However, the user can do "update table1 set field1=xx".
Is this right? Any explanations why it should be like this and any suggestions
on how to get around it without granting select is greatly appreciated.
KP
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: Need SELECT rights to UPDATE/DELETE WHERE?
@ 2005-02-01 05:34 Tom Lane <tgl@sss.pgh.pa.us>
parent: cpp@world-online.no
0 siblings, 0 replies; 2+ messages in thread
From: Tom Lane @ 2005-02-01 05:34 UTC (permalink / raw)
To: cpp@world-online.no; +Cc: pgsql-sql
cpp@world-online.no writes:
> In my hands it looks like a user with INSERT/DELETE/UPDATE rights on table1
> cannot do "update table1 set field1=xx where field2=yy" without also being
> granted select rights. However, the user can do "update table1 set field1=xx".
> Is this right?
Yes. Otherwise you can use UPDATEs to infer something about the content
of the table, eg do
update table1 set field1 = field1 where field2 = yy
and note the result count to find out whether there are any rows with
field2 = yy. If you didn't give the other guy SELECT rights then
presumably you do not want him to be able to infer any such thing.
regards, tom lane
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2005-02-01 05:34 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2005-01-27 15:46 Need SELECT rights to UPDATE/DELETE WHERE? cpp@world-online.no
2005-02-01 05:34 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox