database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-29 10:41:53 +03:00
Code Activity

Fix cascading privilege revoke to notice when privileges are still held.

Browse Source 
If we revoke a grant option from some role X, but X still holds the option
via another grant, we should not recursively revoke the privilege from
role(s) Y that X had granted it to.  This was supposedly fixed as one
aspect of commit 4b2dafcc0b, but I must not
have tested it, because in fact that code never worked: it forgot to shift
the grant-option bits back over when masking the bits being revoked.

Per bug #6728 from Daniel German.  Back-patch to all active branches,
since this has been wrong since 8.0.
This commit is contained in:
Tom Lane
2012-08-23 17:25:33 -04:00
parent dda44070cc
commit d6a3863506
3 changed files with 76 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/backend/utils/adt/acl.c
View File

@ -1030,11 +1030,11 @@ recursive_revoke(Acl *acl,
if (grantee == ownerId)
return acl;
/* The grantee might still have the privileges via another grantor */
/* The grantee might still have some grant options via another grantor */
still_has = aclmask(acl, grantee, ownerId,
ACL_GRANT_OPTION_FOR(revoke_privs),
ACLMASK_ALL);
revoke_privs &= ~still_has;
revoke_privs &= ~ACL_OPTION_TO_PRIVS(still_has);
if (revoke_privs == ACL_NO_RIGHTS)
return acl;