database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-11-04 20:11:56 +03:00
Code Activity

Represent columns requiring insert and update privileges indentently.

Browse Source 
Previously, relation range table entries used a single Bitmapset field
representing which columns required either UPDATE or INSERT privileges,
despite the fact that INSERT and UPDATE privileges are separately
cataloged, and may be independently held.  As statements so far required
either insert or update privileges but never both, that was
sufficient. The required permission could be inferred from the top level
statement run.

The upcoming INSERT ... ON CONFLICT UPDATE feature needs to
independently check for both privileges in one statement though, so that
is not sufficient anymore.

Bumps catversion as stored rules change.

Author: Peter Geoghegan
Reviewed-By: Andres Freund
This commit is contained in:
Andres Freund
2015-05-08 00:20:46 +02:00
parent db5f98ab4f
commit 2c8f4836db
18 changed files with 193 additions and 125 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/backend/optimizer/prep/prepsecurity.c
View File

@@ -125,7 +125,8 @@ expand_security_quals(PlannerInfo *root, List *tlist)
rte->requiredPerms = 0;
rte->checkAsUser = InvalidOid;
rte->selectedCols = NULL;
rte->modifiedCols = NULL;
rte->insertedCols = NULL;
rte->updatedCols = NULL;
/*
* For the most part, Vars referencing the original relation
@@ -224,7 +225,8 @@ expand_security_qual(PlannerInfo *root, List *tlist, int rt_index,
rte->requiredPerms = 0;
rte->checkAsUser = InvalidOid;
rte->selectedCols = NULL;
rte->modifiedCols = NULL;
rte->insertedCols = NULL;
rte->updatedCols = NULL;
/*
* Now deal with any PlanRowMark on this RTE by requesting a lock

8
src/backend/optimizer/prep/prepunion.c
View File

@@ -1368,14 +1368,16 @@ expand_inherited_rtentry(PlannerInfo *root, RangeTblEntry *rte, Index rti)
* if this is the parent table, leave copyObject's result alone.
*
* Note: we need to do this even though the executor won't run any
* permissions checks on the child RTE. The modifiedCols bitmap may
* be examined for trigger-firing purposes.
* permissions checks on the child RTE. The insertedCols/updatedCols
* bitmaps may be examined for trigger-firing purposes.
*/
if (childOID != parentOID)
{
childrte->selectedCols = translate_col_privs(rte->selectedCols,
appinfo->translated_vars);
childrte->modifiedCols = translate_col_privs(rte->modifiedCols,
childrte->insertedCols = translate_col_privs(rte->insertedCols,
appinfo->translated_vars);
childrte->updatedCols = translate_col_privs(rte->updatedCols,
appinfo->translated_vars);
}