Skip to content

Commit b762bbd

Browse files
tglsfdctglsfdc
committed
Allow makeaclitem() to accept multiple privilege names.
Interpret its privileges argument as a comma-separated list of privilege names, as in has_table_privilege and other functions. This is actually net less code, since the support routine to parse that already exists, and we can drop convert_priv_string() which had no other use-case. Robins Tharakan Discussion: https://postgr.es/m/e5a05dc54ba64408b3dd260171c1abaf@EX13D05UWC001.ant.amazon.com
1 parent b6a5158 commit b762bbd

File tree

4 files changed

+54
-47
lines changed

4 files changed

+54
-47
lines changed

‎doc/src/sgml/func.sgml

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24236,7 +24236,8 @@ SELECT has_function_privilege('joeuser', 'myfunc(int, text)', 'execute');
2423624236
If the grantee is the pseudo-role PUBLIC, it is represented by zero in
2423724237
the <parameter>grantee</parameter> column. Each granted privilege is
2423824238
represented as <literal>SELECT</literal>, <literal>INSERT</literal>,
24239-
etc. Note that each privilege is broken out as a separate row, so
24239+
etc (see <xref linkend="privilege-abbrevs-table"/> for a full list).
24240+
Note that each privilege is broken out as a separate row, so
2424024241
only one keyword appears in the <parameter>privilege_type</parameter>
2424124242
column.
2424224243
</para></entry>
@@ -24256,6 +24257,12 @@ SELECT has_function_privilege('joeuser', 'myfunc(int, text)', 'execute');
2425624257
</para>
2425724258
<para>
2425824259
Constructs an <type>aclitem</type> with the given properties.
24260+
<parameter>privileges</parameter> is a comma-separated list of
24261+
privilege names such as <literal>SELECT</literal>,
24262+
<literal>INSERT</literal>, etc, all of which are set in the
24263+
result. (Case of the privilege string is not significant, and
24264+
extra whitespace is allowed between but not within privilege
24265+
names.)
2425924266
</para></entry>
2426024267
</row>
2426124268
</tbody>

‎src/backend/utils/adt/acl.c

Lines changed: 20 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,6 @@ static void check_circularity(const Acl *old_acl, const AclItem *mod_aip,
8686
static Acl *recursive_revoke(Acl *acl, Oid grantee, AclMode revoke_privs,
8787
Oid ownerId, DropBehavior behavior);
8888

89-
static AclMode convert_priv_string(text *priv_type_text);
9089
static AclMode convert_any_priv_string(text *priv_type_text,
9190
const priv_map *privileges);
9291

@@ -1573,8 +1572,27 @@ makeaclitem(PG_FUNCTION_ARGS)
15731572
bool goption = PG_GETARG_BOOL(3);
15741573
AclItem *result;
15751574
AclMode priv;
1575+
static const priv_map any_priv_map[] = {
1576+
{"SELECT", ACL_SELECT},
1577+
{"INSERT", ACL_INSERT},
1578+
{"UPDATE", ACL_UPDATE},
1579+
{"DELETE", ACL_DELETE},
1580+
{"TRUNCATE", ACL_TRUNCATE},
1581+
{"REFERENCES", ACL_REFERENCES},
1582+
{"TRIGGER", ACL_TRIGGER},
1583+
{"EXECUTE", ACL_EXECUTE},
1584+
{"USAGE", ACL_USAGE},
1585+
{"CREATE", ACL_CREATE},
1586+
{"TEMP", ACL_CREATE_TEMP},
1587+
{"TEMPORARY", ACL_CREATE_TEMP},
1588+
{"CONNECT", ACL_CONNECT},
1589+
{"SET", ACL_SET},
1590+
{"ALTER SYSTEM", ACL_ALTER_SYSTEM},
1591+
{"RULE", 0}, /* ignore old RULE privileges */
1592+
{NULL, 0}
1593+
};
15761594

1577-
priv = convert_priv_string(privtext);
1595+
priv = convert_any_priv_string(privtext, any_priv_map);
15781596

15791597
result = (AclItem *) palloc(sizeof(AclItem));
15801598

@@ -1587,50 +1605,6 @@ makeaclitem(PG_FUNCTION_ARGS)
15871605
PG_RETURN_ACLITEM_P(result);
15881606
}
15891607

1590-
static AclMode
1591-
convert_priv_string(text *priv_type_text)
1592-
{
1593-
char *priv_type = text_to_cstring(priv_type_text);
1594-
1595-
if (pg_strcasecmp(priv_type, "SELECT") == 0)
1596-
return ACL_SELECT;
1597-
if (pg_strcasecmp(priv_type, "INSERT") == 0)
1598-
return ACL_INSERT;
1599-
if (pg_strcasecmp(priv_type, "UPDATE") == 0)
1600-
return ACL_UPDATE;
1601-
if (pg_strcasecmp(priv_type, "DELETE") == 0)
1602-
return ACL_DELETE;
1603-
if (pg_strcasecmp(priv_type, "TRUNCATE") == 0)
1604-
return ACL_TRUNCATE;
1605-
if (pg_strcasecmp(priv_type, "REFERENCES") == 0)
1606-
return ACL_REFERENCES;
1607-
if (pg_strcasecmp(priv_type, "TRIGGER") == 0)
1608-
return ACL_TRIGGER;
1609-
if (pg_strcasecmp(priv_type, "EXECUTE") == 0)
1610-
return ACL_EXECUTE;
1611-
if (pg_strcasecmp(priv_type, "USAGE") == 0)
1612-
return ACL_USAGE;
1613-
if (pg_strcasecmp(priv_type, "CREATE") == 0)
1614-
return ACL_CREATE;
1615-
if (pg_strcasecmp(priv_type, "TEMP") == 0)
1616-
return ACL_CREATE_TEMP;
1617-
if (pg_strcasecmp(priv_type, "TEMPORARY") == 0)
1618-
return ACL_CREATE_TEMP;
1619-
if (pg_strcasecmp(priv_type, "CONNECT") == 0)
1620-
return ACL_CONNECT;
1621-
if (pg_strcasecmp(priv_type, "SET") == 0)
1622-
return ACL_SET;
1623-
if (pg_strcasecmp(priv_type, "ALTER SYSTEM") == 0)
1624-
return ACL_ALTER_SYSTEM;
1625-
if (pg_strcasecmp(priv_type, "RULE") == 0)
1626-
return 0; /* ignore old RULE privileges */
1627-
1628-
ereport(ERROR,
1629-
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
1630-
errmsg("unrecognized privilege type: \"%s\"", priv_type)));
1631-
return ACL_NO_RIGHTS; /* keep compiler quiet */
1632-
}
1633-
16341608

16351609
/*
16361610
* convert_any_priv_string: recognize privilege strings for has_foo_privilege

‎src/test/regress/expected/privileges.out

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2099,6 +2099,24 @@ SELECT has_table_privilege('regress_priv_user1', 'testns.acltest1', 'INSERT'); -
20992099
ALTER DEFAULT PRIVILEGES FOR ROLE regress_priv_user1 REVOKE EXECUTE ON FUNCTIONS FROM public;
21002100
ALTER DEFAULT PRIVILEGES IN SCHEMA testns GRANT USAGE ON SCHEMAS TO regress_priv_user2; -- error
21012101
ERROR: cannot use IN SCHEMA clause when using GRANT/REVOKE ON SCHEMAS
2102+
-- Test makeaclitem()
2103+
SELECT makeaclitem('regress_priv_user1'::regrole, 'regress_priv_user2'::regrole,
2104+
'SELECT', TRUE); -- single privilege
2105+
makeaclitem
2106+
------------------------------------------
2107+
regress_priv_user1=r*/regress_priv_user2
2108+
(1 row)
2109+
2110+
SELECT makeaclitem('regress_priv_user1'::regrole, 'regress_priv_user2'::regrole,
2111+
'SELECT, INSERT, UPDATE , DELETE ', FALSE); -- multiple privileges
2112+
makeaclitem
2113+
--------------------------------------------
2114+
regress_priv_user1=arwd/regress_priv_user2
2115+
(1 row)
2116+
2117+
SELECT makeaclitem('regress_priv_user1'::regrole, 'regress_priv_user2'::regrole,
2118+
'SELECT, fake_privilege', FALSE); -- error
2119+
ERROR: unrecognized privilege type: "fake_privilege"
21022120
--
21032121
-- Testing blanket default grants is very hazardous since it might change
21042122
-- the privileges attached to objects created by concurrent regression tests.

‎src/test/regress/sql/privileges.sql

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1339,6 +1339,14 @@ ALTER DEFAULT PRIVILEGES FOR ROLE regress_priv_user1 REVOKE EXECUTE ON FUNCTIONS
13391339

13401340
ALTER DEFAULT PRIVILEGES IN SCHEMA testns GRANT USAGE ON SCHEMAS TO regress_priv_user2; -- error
13411341

1342+
-- Test makeaclitem()
1343+
SELECT makeaclitem('regress_priv_user1'::regrole, 'regress_priv_user2'::regrole,
1344+
'SELECT', TRUE); -- single privilege
1345+
SELECT makeaclitem('regress_priv_user1'::regrole, 'regress_priv_user2'::regrole,
1346+
'SELECT, INSERT, UPDATE , DELETE ', FALSE); -- multiple privileges
1347+
SELECT makeaclitem('regress_priv_user1'::regrole, 'regress_priv_user2'::regrole,
1348+
'SELECT, fake_privilege', FALSE); -- error
1349+
13421350
--
13431351
-- Testing blanket default grants is very hazardous since it might change
13441352
-- the privileges attached to objects created by concurrent regression tests.

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy