From: Tom Lane <tgl@sss.pgh.pa.us>
To: Eugene E. <sad@bankir.ru>
Cc: pgsql-sql@postgresql.org
Subject: Re: Permission to Select
Date: Mon, 13 Mar 2006 10:27:27 -0500
Message-ID: <7412.1142263647@sss.pgh.pa.us> (raw)
In-Reply-To: <441540AA.3090202@bankir.ru>
References: <Pine.LNX.4.44.0507280919020.4325-100000@matrix.gatewaynet.com>
<441540AA.3090202@bankir.ru>
"Eugene E." <sad@bankir.ru> writes:
> db=# REVOKE all ON t FROM u;
> db=# GRANT update,insert,delete ON t TO u;
> db=# \c - u
> db=> INSERT INTO t VALUES (1,'x');
> INSERT
> db=> UPDATE t SET a='y' WHERE i=1;
> ERROR: Permission denied for relation t;
> db=> UPDATE t SET a='y';
> UPDATE
This behavior is correct and as documented in the UPDATE reference page:
You must have the UPDATE privilege on the table to update it, as
well as the SELECT privilege to any table whose values are read
in the expressions or condition.
The use of "i" in the WHERE clause is what causes SELECT privilege to be
needed.
If we had per-column privileges then we could be finer-grained about it,
but we don't (yet).
> Please examine the following patch and make your judgment:
This patch is so wrong it's not even worth discussing :-(
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: tgl@sss.pgh.pa.us, sad@bankir.ru
Subject: Re: Permission to Select
In-Reply-To: <7412.1142263647@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox