database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-10-18 04:29:09 +03:00
Code Activity

dblink: Avoid locking relation before privilege check.

Browse Source 
The present coding of dblink's get_rel_from_relname() predates the
introduction of RangeVarGetRelidExtended(), which provides a way to
check permissions before locking the relation.  This commit adjusts
get_rel_from_relname() to use that function.

Reviewed-by: Jeff Davis <pgsql@j-davis.com>
Discussion: https://postgr.es/m/aOgmi6avE6qMw_6t%40nathan
This commit is contained in:
Nathan Bossart
2025-10-14 12:20:48 -05:00
parent 4a8fb58671
commit c9b299f6df
1 changed files with 19 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
contrib/dblink/dblink.c
View File

@@ -2460,6 +2460,21 @@ get_tuple_of_interest(Relation rel, int *pkattnums, int pknumatts, char **src_pk
return NULL;
}
static void
RangeVarCallbackForDblink(const RangeVar *relation,
Oid relId, Oid oldRelId, void *arg)
{
AclResult aclresult;
if (!OidIsValid(relId))
return;
aclresult = pg_class_aclcheck(relId, GetUserId(), *((AclMode *) arg));
if (aclresult != ACLCHECK_OK)
aclcheck_error(aclresult, get_relkind_objtype(get_rel_relkind(relId)),
relation->relname);
}
/*
* Open the relation named by relname_text, acquire specified type of lock,
* verify we have specified permissions.
@@ -2469,19 +2484,13 @@ static Relation
get_rel_from_relname(text *relname_text, LOCKMODE lockmode, AclMode aclmode)
{
RangeVar *relvar;
Relation rel;
AclResult aclresult;
Oid relid;
relvar = makeRangeVarFromNameList(textToQualifiedNameList(relname_text));
rel = table_openrv(relvar, lockmode);
relid = RangeVarGetRelidExtended(relvar, lockmode, 0,
RangeVarCallbackForDblink, &aclmode);
aclresult = pg_class_aclcheck(RelationGetRelid(rel), GetUserId(),
aclmode);
if (aclresult != ACLCHECK_OK)
aclcheck_error(aclresult, get_relkind_objtype(rel->rd_rel->relkind),
RelationGetRelationName(rel));
return rel;
return table_open(relid, NoLock);
}
/*