database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-08-25 20:23:07 +03:00
Code Activity

Fix thinko in recent patch to change temp-table permissions behavior:

Browse Source 
this is an aclmask function and does not have the same return convention
as aclcheck functions.  Also adjust the behavior so that users without
CREATE TEMP permission still have USAGE permission on their session's
temp schema.  This allows privileged code to create a temp table and
make it accessible to code that's not got the same privilege.  (Since
the default permissions on a table are no-access, an explicit grant on
the table will still be needed; but I see no reason that the temp schema
itself should prohibit such access.)
This commit is contained in:
Tom Lane
2004-05-28 16:17:14 +00:00
parent a6ea6457fa
commit d707495452
2 changed files with 28 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/backend/catalog/namespace.c
View File

@@ -13,7 +13,7 @@
* Portions Copyright (c) 1994, Regents of the University of California
*
* IDENTIFICATION
* $PostgreSQL: pgsql/src/backend/catalog/namespace.c,v 1.65 2004/05/26 18:35:32 momjian Exp $
* $PostgreSQL: pgsql/src/backend/catalog/namespace.c,v 1.66 2004/05/28 16:17:14 tgl Exp $
*
*-------------------------------------------------------------------------
*/
@@ -1640,9 +1640,10 @@ InitTempTableNamespace(void)
* tables. We use a nonstandard error message here since
* "databasename: permission denied" might be a tad cryptic.
*
* ACL_CREATE_TEMP perms are also checked in
* pg_namespace_aclcheck() that way only users who have TEMP
* perms can create objects.
* Note that ACL_CREATE_TEMP rights are rechecked in pg_namespace_aclmask;
* that's necessary since current user ID could change during the session.
* But there's no need to make the namespace in the first place until a
* temp table creation request is made by someone with appropriate rights.
*/
if (pg_database_aclcheck(MyDatabaseId, GetUserId(),
ACL_CREATE_TEMP) != ACLCHECK_OK)