From: Eugene E. <sad@bankir.ru>
To: pgsql-sql@postgresql.org
Subject: Permission to Select
Date: Mon, 13 Mar 2006 12:51:38 +0300
Message-ID: <441540AA.3090202@bankir.ru> (raw)
In-Reply-To: <Pine.LNX.4.44.0507280919020.4325-100000@matrix.gatewaynet.com>
References: <Pine.LNX.4.44.0507280919020.4325-100000@matrix.gatewaynet.com>
Hi all
the serious problem with permissions is encountered
NOTE: the following example is really useful but there is no room to
describe it's use.
db=# CREATE USER u;
db=# CREATE TABLE t (i int, a text);
db=# REVOKE all ON t FROM u;
db=# GRANT update,insert,delete ON t TO u;
db=# \c - u
db=> INSERT INTO t VALUES (1,'x');
INSERT
db=> UPDATE t SET a='y' WHERE i=1;
ERROR: Permission denied for relation t;
db=> UPDATE t SET a='y';
UPDATE
1) The user "u" is permitted but unable to perfom the operation !
2) A user is able to update WHOLE table but unable to update ANY part of
it !
Please examine the following patch and make your judgment:
inline patch 1: src/backend/executor/execMain.c (+0/-0 lines) download inline-1.patch--- src/backend/executor/execMain.c.orig 2005-11-22 1:23:08.000000000 +0300+++ src/backend/executor/execMain.c 2006-02-17 13:19:29.000000000 +0300@@ -460,6 +460,16 @@bool do_select_into;
TupleDesc tupType;
+ if ( operation == CMD_UPDATE || operation == CMD_DELETE )
+ {
+ ListCell *l;
+ foreach(l, parseTree->rtable)
+ {
+ RangeTblEntry *rte = lfirst(l);
+ rte->requiredPerms ^= ACL_SELECT;
+ }
+ }
+
/*
* Do permissions checks. It's sufficient to examine the query's top
* rangetable here --- subplan RTEs will be checked during
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: sad@bankir.ru
Subject: Re: Permission to Select
In-Reply-To: <441540AA.3090202@bankir.ru>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox