database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-05-17 06:41:24 +03:00
Code

Improve GRANT documentation to point out that UPDATE and DELETE typically

Browse Source 
require SELECT privilege as well, since you normally need to read existing
column values within such commands.  This behavior is according to spec,
but we'd never documented it before.  Per gripe from Volkan Yazici.
This commit is contained in:
Tom Lane 2008-05-28 00:46:12 +00:00
parent c59eef17c9
commit 8b0d5949a8
1 changed files with 28 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
doc/src/sgml/ref/grant.sgml
View File

@ -1,5 +1,5 @@
<!-- <!--
$Header: /cvsroot/pgsql/doc/src/sgml/ref/grant.sgml,v 1.37 2003/10/31 20:00:48 tgl Exp $ $Header: /cvsroot/pgsql/doc/src/sgml/ref/grant.sgml,v 1.37.2.1 2008/05/28 00:46:12 tgl Exp $
PostgreSQL documentation PostgreSQL documentation
--> -->
@ -104,10 +104,15 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
<term>SELECT</term> <term>SELECT</term>
<listitem> <listitem>
<para> <para>
Allows <xref linkend="sql-select" endterm="sql-select-title"> from any column of the Allows <xref linkend="sql-select" endterm="sql-select-title"> from
specified table, view, or sequence. Also allows the use of any column of the specified table, view, or sequence.
<xref linkend="sql-copy" endterm="sql-copy-title"> TO. For sequences, this Also allows the use of
privilege also allows the use of the <function>currval</function> function. <xref linkend="sql-copy" endterm="sql-copy-title"> TO.
This privilege is also needed to reference existing column values in
<xref linkend="sql-update" endterm="sql-update-title"> or
<xref linkend="sql-delete" endterm="sql-delete-title">.
For sequences, this privilege also allows the use of the
<function>currval</function> function.
</para> </para>
</listitem> </listitem>
</varlistentry> </varlistentry>
@ -116,8 +121,9 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
<term>INSERT</term> <term>INSERT</term>
<listitem> <listitem>
<para> <para>
Allows <xref linkend="sql-insert" endterm="sql-insert-title"> of a new row into the Allows <xref linkend="sql-insert" endterm="sql-insert-title"> of a new
specified table. Also allows <xref linkend="sql-copy" endterm="sql-copy-title"> FROM. row into the specified table.
Also allows <xref linkend="sql-copy" endterm="sql-copy-title"> FROM.
</para> </para>
</listitem> </listitem>
</varlistentry> </varlistentry>
@ -126,10 +132,15 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
<term>UPDATE</term> <term>UPDATE</term>
<listitem> <listitem>
<para> <para>
Allows <xref linkend="sql-update" endterm="sql-update-title"> of any column of the Allows <xref linkend="sql-update" endterm="sql-update-title"> of any
specified table. <literal>SELECT ... FOR UPDATE</literal> column of the specified table.
also requires this privilege (besides the (In practice, any nontrivial <command>UPDATE</> command will require
<literal>SELECT</literal> privilege). For sequences, this <literal>SELECT</> privilege as well, since it must reference table
columns to determine which rows to update, and/or to compute new
values for columns.)
<literal>SELECT ... FOR UPDATE</literal>
also requires this privilege, in addition to the
<literal>SELECT</literal> privilege. For sequences, this
privilege allows the use of the <function>nextval</function> and privilege allows the use of the <function>nextval</function> and
<function>setval</function> functions. <function>setval</function> functions.
</para> </para>
@ -140,8 +151,11 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
<term>DELETE</term> <term>DELETE</term>
<listitem> <listitem>
<para> <para>
Allows <xref linkend="sql-delete" endterm="sql-delete-title"> of a row from the Allows <xref linkend="sql-delete" endterm="sql-delete-title"> of a row
specified table. from the specified table.
(In practice, any nontrivial <command>DELETE</> command will require
<literal>SELECT</> privilege as well, since it must reference table
columns to determine which rows to delete.)
</para> </para>
</listitem> </listitem>
</varlistentry> </varlistentry>
@ -196,7 +210,7 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
<term>TEMP</term> <term>TEMP</term>
<listitem> <listitem>
<para> <para>
Allows temporary tables to be created while using the database. Allows temporary tables to be created while using the specified database.
</para> </para>
</listitem> </listitem>
</varlistentry> </varlistentry>