Skip to content

Commit b1362f8

Browse files
afiskonafiskon
committed
Apply new/0006-Add-clause-PASSWORD-val-USING-protocol-to-CREATE-ALT.patch
1 parent a8007eb commit b1362f8

File tree

4 files changed

+126
-7
lines changed

4 files changed

+126
-7
lines changed

‎doc/src/sgml/ref/alter_role.sgml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ ALTER ROLE <replaceable class="PARAMETER">role_specification</replaceable> [ WIT
3434
| BYPASSRLS | NOBYPASSRLS
3535
| CONNECTION LIMIT <replaceable class="PARAMETER">connlimit</replaceable>
3636
| [ ENCRYPTED | UNENCRYPTED ] PASSWORD '<replaceable class="PARAMETER">password</replaceable>'
37+
| PASSWORD ( '<replaceable class="PARAMETER">password</replaceable>' USING '<replaceable class="PARAMETER">method</replaceable>' )
3738
| VALID UNTIL '<replaceable class="PARAMETER">timestamp</replaceable>'
3839

3940
ALTER ROLE <replaceable class="PARAMETER">name</replaceable> RENAME TO <replaceable>new_name</replaceable>
@@ -169,6 +170,7 @@ ALTER ROLE { <replaceable class="PARAMETER">role_specification</replaceable> | A
169170
<term><literal>NOBYPASSRLS</literal></term>
170171
<term><literal>CONNECTION LIMIT</literal> <replaceable class="parameter">connlimit</replaceable></term>
171172
<term><literal>PASSWORD</> <replaceable class="parameter">password</replaceable></term>
173+
<term><literal>PASSWORD</> ( '<replaceable class="parameter">password</replaceable>' USING '<replaceable class="parameter">method</replaceable>' )</term>
172174
<term><literal>ENCRYPTED</></term>
173175
<term><literal>UNENCRYPTED</></term>
174176
<term><literal>VALID UNTIL</literal> '<replaceable class="parameter">timestamp</replaceable>'</term>
@@ -279,6 +281,14 @@ ALTER ROLE davide WITH PASSWORD 'hu8jmn3';
279281
</programlisting>
280282
</para>
281283

284+
<para>
285+
Change a role's password using MD5-encryption:
286+
287+
<programlisting>
288+
ALTER ROLE lionel WITH PASSWORD ('hu8jmn3' USING 'md5');
289+
</programlisting>
290+
</para>
291+
282292
<para>
283293
Remove a role's password:
284294

‎doc/src/sgml/ref/create_role.sgml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ CREATE ROLE <replaceable class="PARAMETER">name</replaceable> [ [ WITH ] <replac
3434
| BYPASSRLS | NOBYPASSRLS
3535
| CONNECTION LIMIT <replaceable class="PARAMETER">connlimit</replaceable>
3636
| [ ENCRYPTED | UNENCRYPTED ] PASSWORD '<replaceable class="PARAMETER">password</replaceable>'
37+
| PASSWORD ( '<replaceable class="PARAMETER">password</replaceable>' USING '<replaceable class="PARAMETER">method</replaceable>' )
3738
| VALID UNTIL '<replaceable class="PARAMETER">timestamp</replaceable>'
3839
| IN ROLE <replaceable class="PARAMETER">role_name</replaceable> [, ...]
3940
| IN GROUP <replaceable class="PARAMETER">role_name</replaceable> [, ...]
@@ -244,6 +245,23 @@ CREATE ROLE <replaceable class="PARAMETER">name</replaceable> [ [ WITH ] <replac
244245
</listitem>
245246
</varlistentry>
246247

248+
<varlistentry>
249+
<term><literal>PASSWORD</> ( '<replaceable class="parameter">password</replaceable>' USING '<replaceable class="parameter">method</replaceable>' )</term>
250+
<listitem>
251+
<para>
252+
Sets the role's password using the requested method. (A password
253+
is only of use for roles having the <literal>LOGIN</literal>
254+
attribute, but you can nonetheless define one for roles without it.)
255+
If you do not plan to use password authentication you can omit this
256+
option. The methods supported are <literal>md5</> to enforce
257+
a password to be MD5-encrypted, and <literal>plain</> to use an
258+
unencrypted password. If the password string is already in
259+
MD5-encrypted format, then it is stored encrypted even if
260+
<literal>plain</> is specified.
261+
</para>
262+
</listitem>
263+
</varlistentry>
264+
247265
<varlistentry>
248266
<term><literal>VALID UNTIL</literal> '<replaceable class="parameter">timestamp</replaceable>'</term>
249267
<listitem>
@@ -425,6 +443,14 @@ CREATE USER davide WITH PASSWORD 'jw8s0F4';
425443
that it implies <literal>LOGIN</>.)
426444
</para>
427445

446+
<para>
447+
Create a role with a MD5-encrypted password:
448+
449+
<programlisting>
450+
CREATE USER lionel WITH PASSWORD ('asdh7as' USING 'md5');
451+
</programlisting>
452+
</para>
453+
428454
<para>
429455
Create a role with a password that is valid until the end of 2004.
430456
After one second has ticked in 2005, the password is no longer

‎src/backend/commands/user.c

Lines changed: 83 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -176,18 +176,58 @@ CreateRole(ParseState *pstate, CreateRoleStmt *stmt)
176176

177177
if (strcmp(defel->defname, "password") == 0 ||
178178
strcmp(defel->defname, "encryptedPassword") == 0 ||
179-
strcmp(defel->defname, "unencryptedPassword") == 0)
179+
strcmp(defel->defname, "unencryptedPassword") == 0 ||
180+
strcmp(defel->defname, "methodPassword") == 0)
180181
{
181182
if (dpassword)
182183
ereport(ERROR,
183184
(errcode(ERRCODE_SYNTAX_ERROR),
184185
errmsg("conflicting or redundant options"),
185186
parser_errposition(pstate, defel->location)));
186187
dpassword = defel;
187-
if (strcmp(defel->defname, "encryptedPassword") == 0)
188+
if (strcmp(defel->defname, "password") == 0)
189+
{
190+
/*
191+
* Password type is enforced with GUC password_encryption
192+
* here.
193+
*/
194+
if (dpassword && dpassword->arg)
195+
password = strVal(dpassword->arg);
196+
}
197+
else if (strcmp(defel->defname, "encryptedPassword") == 0)
198+
{
188199
password_type = PASSWORD_TYPE_MD5;
200+
if (dpassword && dpassword->arg)
201+
password = strVal(dpassword->arg);
202+
}
189203
else if (strcmp(defel->defname, "unencryptedPassword") == 0)
204+
{
190205
password_type = PASSWORD_TYPE_PLAINTEXT;
206+
if (dpassword && dpassword->arg)
207+
password = strVal(dpassword->arg);
208+
}
209+
else if (strcmp(defel->defname, "methodPassword") == 0)
210+
{
211+
/*
212+
* This is a list of two elements, the password is first and
213+
* then there is the method wanted by caller.
214+
*/
215+
if (dpassword && dpassword->arg)
216+
{
217+
char *method = strVal(lsecond((List *) dpassword->arg));
218+
219+
password = strVal(linitial((List *) dpassword->arg));
220+
221+
if (strcmp(method, "md5") == 0)
222+
password_type = PASSWORD_TYPE_MD5;
223+
else if (strcmp(method, "plain") == 0)
224+
password_type = PASSWORD_TYPE_PLAINTEXT;
225+
else
226+
ereport(ERROR,
227+
(errcode(ERRCODE_SYNTAX_ERROR),
228+
errmsg("unsupported password method %s", method)));
229+
}
230+
}
191231
}
192232
else if (strcmp(defel->defname, "sysid") == 0)
193233
{
@@ -307,8 +347,6 @@ CreateRole(ParseState *pstate, CreateRoleStmt *stmt)
307347
defel->defname);
308348
}
309349

310-
if (dpassword && dpassword->arg)
311-
password = strVal(dpassword->arg);
312350
if (dissuper)
313351
issuper = intVal(dissuper->arg) != 0;
314352
if (dinherit)
@@ -582,17 +620,57 @@ AlterRole(AlterRoleStmt *stmt)
582620

583621
if (strcmp(defel->defname, "password") == 0 ||
584622
strcmp(defel->defname, "encryptedPassword") == 0 ||
623+
strcmp(defel->defname, "methodPassword") == 0 ||
585624
strcmp(defel->defname, "unencryptedPassword") == 0)
586625
{
587626
if (dpassword)
588627
ereport(ERROR,
589628
(errcode(ERRCODE_SYNTAX_ERROR),
590629
errmsg("conflicting or redundant options")));
591630
dpassword = defel;
592-
if (strcmp(defel->defname, "encryptedPassword") == 0)
631+
if (strcmp(defel->defname, "password") == 0)
632+
{
633+
/*
634+
* Password type is enforced with GUC password_encryption
635+
* here.
636+
*/
637+
if (dpassword && dpassword->arg)
638+
password = strVal(dpassword->arg);
639+
}
640+
else if (strcmp(defel->defname, "encryptedPassword") == 0)
641+
{
593642
password_type = PASSWORD_TYPE_MD5;
643+
if (dpassword && dpassword->arg)
644+
password = strVal(dpassword->arg);
645+
}
594646
else if (strcmp(defel->defname, "unencryptedPassword") == 0)
647+
{
595648
password_type = PASSWORD_TYPE_PLAINTEXT;
649+
if (dpassword && dpassword->arg)
650+
password = strVal(dpassword->arg);
651+
}
652+
else if (strcmp(defel->defname, "methodPassword") == 0)
653+
{
654+
/*
655+
* This is a list of two elements, the password is first and
656+
* then there is the method wanted by caller.
657+
*/
658+
if (dpassword && dpassword->arg)
659+
{
660+
char *method = strVal(lsecond((List *) dpassword->arg));
661+
662+
if (strcmp(method, "md5") == 0)
663+
password_type = PASSWORD_TYPE_MD5;
664+
else if (strcmp(method, "plain") == 0)
665+
password_type = PASSWORD_TYPE_PLAINTEXT;
666+
else
667+
ereport(ERROR,
668+
(errcode(ERRCODE_SYNTAX_ERROR),
669+
errmsg("unsupported password method %s", method)));
670+
671+
password = strVal(linitial((List *) dpassword->arg));
672+
}
673+
}
596674
}
597675
else if (strcmp(defel->defname, "superuser") == 0)
598676
{
@@ -680,8 +758,6 @@ AlterRole(AlterRoleStmt *stmt)
680758
defel->defname);
681759
}
682760

683-
if (dpassword && dpassword->arg)
684-
password = strVal(dpassword->arg);
685761
if (dissuper)
686762
issuper = intVal(dissuper->arg);
687763
if (dinherit)

‎src/backend/parser/gram.y

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -936,6 +936,13 @@ AlterOptRoleElem:
936936
{
937937
$$ = makeDefElem("password", NULL, @1);
938938
}
939+
| PASSWORD '(' Sconst USING Sconst ')'
940+
{
941+
$$ = makeDefElem("methodPassword",
942+
(Node *)list_make2(makeString($3),
943+
makeString($5)),
944+
@1);
945+
}
939946
| ENCRYPTED PASSWORD Sconst
940947
{
941948
$$ = makeDefElem("encryptedPassword",

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy