database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-02 09:02:37 +03:00
Code Activity

Handle policies during DROP OWNED BY

Browse Source 
DROP OWNED BY handled GRANT-based ACLs but was not removing roles from
policies.  Fix that by having DROP OWNED BY remove the role specified
from the list of roles the policy (or policies) apply to, or the entire
policy (or policies) if it only applied to the role specified.

As with ACLs, the DROP OWNED BY caller must have permission to modify
the policy or a WARNING is thrown and no change is made to the policy.
This commit is contained in:
Stephen Frost
2015-12-11 16:12:25 -05:00
parent 4fcf48450d
commit 833728d4c8
5 changed files with 303 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/test/regress/expected/rowsecurity.out
View File

@ -3289,6 +3289,20 @@ SELECT count(*) = 0 FROM pg_depend
t
(1 row)
-- DROP OWNED BY testing
RESET SESSION AUTHORIZATION;
CREATE ROLE dob_role1;
CREATE ROLE dob_role2;
CREATE TABLE dob_t1 (c1 int);
CREATE POLICY p1 ON dob_t1 TO dob_role1 USING (true);
DROP OWNED BY dob_role1;
DROP POLICY p1 ON dob_t1; -- should fail, already gone
ERROR: policy "p1" for table "dob_t1" does not exist
CREATE POLICY p1 ON dob_t1 TO dob_role1,dob_role2 USING (true);
DROP OWNED BY dob_role1;
DROP POLICY p1 ON dob_t1; -- should succeed
DROP USER dob_role1;
DROP USER dob_role2;
--
-- Clean up objects
--

18
src/test/regress/sql/rowsecurity.sql
View File

@ -1520,6 +1520,24 @@ SELECT count(*) = 0 FROM pg_depend
WHERE objid = (SELECT oid FROM pg_policy WHERE polname = 'dep_p1')
AND refobjid = (SELECT oid FROM pg_class WHERE relname = 'dep2');
-- DROP OWNED BY testing
RESET SESSION AUTHORIZATION;
CREATE ROLE dob_role1;
CREATE ROLE dob_role2;
CREATE TABLE dob_t1 (c1 int);
CREATE POLICY p1 ON dob_t1 TO dob_role1 USING (true);
DROP OWNED BY dob_role1;
DROP POLICY p1 ON dob_t1; -- should fail, already gone
CREATE POLICY p1 ON dob_t1 TO dob_role1,dob_role2 USING (true);
DROP OWNED BY dob_role1;
DROP POLICY p1 ON dob_t1; -- should succeed
DROP USER dob_role1;
DROP USER dob_role2;
--
-- Clean up objects