database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-08-19 23:22:23 +03:00
Code Activity

Fix handling of COMMENT for domain constraints

Browse Source 
For a non-superuser, changing a comment on a domain constraint was
leading to a cache lookup failure as the code tried to perform the
ownership lookup on the constraint OID itself, thinking that it was a
type, but this check needs to happen on the type the domain constraint
relies on.  As the type a domain constraint relies on can be guessed
directly based on the constraint OID, first fetch its type OID and
perform the ownership on it.

This is broken since 7eca575, which has split the handling of comments
for table constraints and domain constraints, so back-patch down to
9.5.

Reported-by: Clemens Ladisch
Author: Daniel Gustafsson, Michael Paquier
Reviewed-by: Álvaro Herrera
Discussion: https://postgr.es/m/15833-808e11904835d26f@postgresql.org
Backpatch-through: 9.5
This commit is contained in:
Michael Paquier
2019-06-12 11:31:14 +09:00
parent b8607e15e0
commit ff1a25601e
3 changed files with 52 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
src/backend/catalog/objectaddress.c
View File

@@ -2096,10 +2096,32 @@ check_object_ownership(Oid roleid, ObjectType objtype, ObjectAddress address,
case OBJECT_TYPE:
case OBJECT_DOMAIN:
case OBJECT_ATTRIBUTE:
case OBJECT_DOMCONSTRAINT:
if (!pg_type_ownercheck(address.objectId, roleid))
aclcheck_error_type(ACLCHECK_NOT_OWNER, address.objectId);
break;
case OBJECT_DOMCONSTRAINT:
{
HeapTuple tuple;
Oid contypid;
tuple = SearchSysCache1(CONSTROID,
ObjectIdGetDatum(address.objectId));
if (!HeapTupleIsValid(tuple))
elog(ERROR, "constraint with OID %u does not exist",
address.objectId);
contypid = ((Form_pg_constraint) GETSTRUCT(tuple))->contypid;
ReleaseSysCache(tuple);
/*
* Fallback to type ownership check in this case as this is
* what domain constraints rely on.
*/
if (!pg_type_ownercheck(contypid, roleid))
aclcheck_error_type(ACLCHECK_NOT_OWNER, contypid);
}
break;
case OBJECT_AGGREGATE:
case OBJECT_FUNCTION:
if (!pg_proc_ownercheck(address.objectId, roleid))