Skip to content

Commit d0f876c

Browse files
ItGackyItGacky
committed
Accept 'public' as a pseudo-role name in has_table_privilege() and friends
to see if a particular privilege has been granted to PUBLIC. The issue was reported by Jim Nasby. Patch by Alvaro Herrera, and reviewed by KaiGai Kohei.
1 parent f4d242e commit d0f876c

File tree

2 files changed

+42
-27
lines changed

2 files changed

+42
-27
lines changed

‎doc/src/sgml/func.sgml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12348,8 +12348,8 @@ SET search_path TO <replaceable>schema</> <optional>, <replaceable>schema</>, ..
1234812348
<para>
1234912349
<function>has_table_privilege</function> checks whether a user
1235012350
can access a table in a particular way. The user can be
12351-
specified by name or by OID
12352-
(<literal>pg_authid.oid</literal>), or if the argument is
12351+
specified by name, by OID (<literal>pg_authid.oid</literal>),
12352+
<literal>public</> to indicate the PUBLIC pseudo-role, or if the argument is
1235312353
omitted
1235412354
<function>current_user</function> is assumed. The table can be specified
1235512355
by name or by OID. (Thus, there are actually six variants of
@@ -12496,7 +12496,8 @@ SELECT has_function_privilege('joeuser', 'myfunc(int, text)', 'execute');
1249612496
<function>pg_has_role</function> checks whether a user
1249712497
can access a role in a particular way.
1249812498
Its argument possibilities
12499-
are analogous to <function>has_table_privilege</function>.
12499+
are analogous to <function>has_table_privilege</function>,
12500+
except that <literal>public</> is not allowed as a user name.
1250012501
The desired access privilege type must evaluate to some combination of
1250112502
<literal>MEMBER</literal> or
1250212503
<literal>USAGE</literal>.

‎src/backend/utils/adt/acl.c

Lines changed: 38 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,7 @@ static AclMode convert_role_priv_string(text *priv_type_text);
113113
static AclResult pg_role_aclcheck(Oid role_oid, Oid roleid, AclMode mode);
114114

115115
static void RoleMembershipCacheCallback(Datum arg, int cacheid, ItemPointer tuplePtr);
116+
static Oid get_role_oid_or_public(const char *rolname);
116117

117118

118119
/*
@@ -1791,7 +1792,7 @@ has_table_privilege_name_name(PG_FUNCTION_ARGS)
17911792
AclMode mode;
17921793
AclResult aclresult;
17931794

1794-
roleid = get_role_oid(NameStr(*rolename), false);
1795+
roleid = get_role_oid_or_public(NameStr(*rolename));
17951796
tableoid = convert_table_name(tablename);
17961797
mode = convert_table_priv_string(priv_type_text);
17971798

@@ -1840,7 +1841,7 @@ has_table_privilege_name_id(PG_FUNCTION_ARGS)
18401841
AclMode mode;
18411842
AclResult aclresult;
18421843

1843-
roleid = get_role_oid(NameStr(*username), false);
1844+
roleid = get_role_oid_or_public(NameStr(*username));
18441845
mode = convert_table_priv_string(priv_type_text);
18451846

18461847
if (!SearchSysCacheExists1(RELOID, ObjectIdGetDatum(tableoid)))
@@ -1998,7 +1999,7 @@ has_sequence_privilege_name_name(PG_FUNCTION_ARGS)
19981999
AclMode mode;
19992000
AclResult aclresult;
20002001

2001-
roleid = get_role_oid(NameStr(*rolename), false);
2002+
roleid = get_role_oid_or_public(NameStr(*rolename));
20022003
mode = convert_sequence_priv_string(priv_type_text);
20032004
sequenceoid = convert_table_name(sequencename);
20042005
if (get_rel_relkind(sequenceoid) != RELKIND_SEQUENCE)
@@ -2058,7 +2059,7 @@ has_sequence_privilege_name_id(PG_FUNCTION_ARGS)
20582059
AclResult aclresult;
20592060
char relkind;
20602061

2061-
roleid = get_role_oid(NameStr(*username), false);
2062+
roleid = get_role_oid_or_public(NameStr(*username));
20622063
mode = convert_sequence_priv_string(priv_type_text);
20632064
relkind = get_rel_relkind(sequenceoid);
20642065
if (relkind == '\0')
@@ -2209,7 +2210,7 @@ has_any_column_privilege_name_name(PG_FUNCTION_ARGS)
22092210
AclMode mode;
22102211
AclResult aclresult;
22112212

2212-
roleid = get_role_oid(NameStr(*rolename), false);
2213+
roleid = get_role_oid_or_public(NameStr(*rolename));
22132214
tableoid = convert_table_name(tablename);
22142215
mode = convert_column_priv_string(priv_type_text);
22152216

@@ -2266,7 +2267,7 @@ has_any_column_privilege_name_id(PG_FUNCTION_ARGS)
22662267
AclMode mode;
22672268
AclResult aclresult;
22682269

2269-
roleid = get_role_oid(NameStr(*username), false);
2270+
roleid = get_role_oid_or_public(NameStr(*username));
22702271
mode = convert_column_priv_string(priv_type_text);
22712272

22722273
if (!SearchSysCacheExists1(RELOID, ObjectIdGetDatum(tableoid)))
@@ -2451,7 +2452,7 @@ has_column_privilege_name_name_name(PG_FUNCTION_ARGS)
24512452
AclMode mode;
24522453
int privresult;
24532454

2454-
roleid = get_role_oid(NameStr(*rolename), false);
2455+
roleid = get_role_oid_or_public(NameStr(*rolename));
24552456
tableoid = convert_table_name(tablename);
24562457
colattnum = convert_column_name(tableoid, column);
24572458
mode = convert_column_priv_string(priv_type_text);
@@ -2479,7 +2480,7 @@ has_column_privilege_name_name_attnum(PG_FUNCTION_ARGS)
24792480
AclMode mode;
24802481
int privresult;
24812482

2482-
roleid = get_role_oid(NameStr(*rolename), false);
2483+
roleid = get_role_oid_or_public(NameStr(*rolename));
24832484
tableoid = convert_table_name(tablename);
24842485
mode = convert_column_priv_string(priv_type_text);
24852486

@@ -2506,7 +2507,7 @@ has_column_privilege_name_id_name(PG_FUNCTION_ARGS)
25062507
AclMode mode;
25072508
int privresult;
25082509

2509-
roleid = get_role_oid(NameStr(*username), false);
2510+
roleid = get_role_oid_or_public(NameStr(*username));
25102511
colattnum = convert_column_name(tableoid, column);
25112512
mode = convert_column_priv_string(priv_type_text);
25122513

@@ -2532,7 +2533,7 @@ has_column_privilege_name_id_attnum(PG_FUNCTION_ARGS)
25322533
AclMode mode;
25332534
int privresult;
25342535

2535-
roleid = get_role_oid(NameStr(*username), false);
2536+
roleid = get_role_oid_or_public(NameStr(*username));
25362537
mode = convert_column_priv_string(priv_type_text);
25372538

25382539
privresult = column_privilege_check(tableoid, colattnum, roleid, mode);
@@ -2823,7 +2824,7 @@ has_database_privilege_name_name(PG_FUNCTION_ARGS)
28232824
AclMode mode;
28242825
AclResult aclresult;
28252826

2826-
roleid = get_role_oid(NameStr(*username), false);
2827+
roleid = get_role_oid_or_public(NameStr(*username));
28272828
databaseoid = convert_database_name(databasename);
28282829
mode = convert_database_priv_string(priv_type_text);
28292830

@@ -2872,7 +2873,7 @@ has_database_privilege_name_id(PG_FUNCTION_ARGS)
28722873
AclMode mode;
28732874
AclResult aclresult;
28742875

2875-
roleid = get_role_oid(NameStr(*username), false);
2876+
roleid = get_role_oid_or_public(NameStr(*username));
28762877
mode = convert_database_priv_string(priv_type_text);
28772878

28782879
if (!SearchSysCacheExists1(DATABASEOID, ObjectIdGetDatum(databaseoid)))
@@ -3021,7 +3022,7 @@ has_foreign_data_wrapper_privilege_name_name(PG_FUNCTION_ARGS)
30213022
AclMode mode;
30223023
AclResult aclresult;
30233024

3024-
roleid = get_role_oid(NameStr(*username), false);
3025+
roleid = get_role_oid_or_public(NameStr(*username));
30253026
fdwid = convert_foreign_data_wrapper_name(fdwname);
30263027
mode = convert_foreign_data_wrapper_priv_string(priv_type_text);
30273028

@@ -3070,7 +3071,7 @@ has_foreign_data_wrapper_privilege_name_id(PG_FUNCTION_ARGS)
30703071
AclMode mode;
30713072
AclResult aclresult;
30723073

3073-
roleid = get_role_oid(NameStr(*username), false);
3074+
roleid = get_role_oid_or_public(NameStr(*username));
30743075
mode = convert_foreign_data_wrapper_priv_string(priv_type_text);
30753076

30763077
aclresult = pg_foreign_data_wrapper_aclcheck(fdwid, roleid, mode);
@@ -3203,7 +3204,7 @@ has_function_privilege_name_name(PG_FUNCTION_ARGS)
32033204
AclMode mode;
32043205
AclResult aclresult;
32053206

3206-
roleid = get_role_oid(NameStr(*username), false);
3207+
roleid = get_role_oid_or_public(NameStr(*username));
32073208
functionoid = convert_function_name(functionname);
32083209
mode = convert_function_priv_string(priv_type_text);
32093210

@@ -3252,7 +3253,7 @@ has_function_privilege_name_id(PG_FUNCTION_ARGS)
32523253
AclMode mode;
32533254
AclResult aclresult;
32543255

3255-
roleid = get_role_oid(NameStr(*username), false);
3256+
roleid = get_role_oid_or_public(NameStr(*username));
32563257
mode = convert_function_priv_string(priv_type_text);
32573258

32583259
if (!SearchSysCacheExists1(PROCOID, ObjectIdGetDatum(functionoid)))
@@ -3403,7 +3404,7 @@ has_language_privilege_name_name(PG_FUNCTION_ARGS)
34033404
AclMode mode;
34043405
AclResult aclresult;
34053406

3406-
roleid = get_role_oid(NameStr(*username), false);
3407+
roleid = get_role_oid_or_public(NameStr(*username));
34073408
languageoid = convert_language_name(languagename);
34083409
mode = convert_language_priv_string(priv_type_text);
34093410

@@ -3452,7 +3453,7 @@ has_language_privilege_name_id(PG_FUNCTION_ARGS)
34523453
AclMode mode;
34533454
AclResult aclresult;
34543455

3455-
roleid = get_role_oid(NameStr(*username), false);
3456+
roleid = get_role_oid_or_public(NameStr(*username));
34563457
mode = convert_language_priv_string(priv_type_text);
34573458

34583459
if (!SearchSysCacheExists1(LANGOID, ObjectIdGetDatum(languageoid)))
@@ -3594,7 +3595,7 @@ has_schema_privilege_name_name(PG_FUNCTION_ARGS)
35943595
AclMode mode;
35953596
AclResult aclresult;
35963597

3597-
roleid = get_role_oid(NameStr(*username), false);
3598+
roleid = get_role_oid_or_public(NameStr(*username));
35983599
schemaoid = convert_schema_name(schemaname);
35993600
mode = convert_schema_priv_string(priv_type_text);
36003601

@@ -3643,7 +3644,7 @@ has_schema_privilege_name_id(PG_FUNCTION_ARGS)
36433644
AclMode mode;
36443645
AclResult aclresult;
36453646

3646-
roleid = get_role_oid(NameStr(*username), false);
3647+
roleid = get_role_oid_or_public(NameStr(*username));
36473648
mode = convert_schema_priv_string(priv_type_text);
36483649

36493650
if (!SearchSysCacheExists1(NAMESPACEOID, ObjectIdGetDatum(schemaoid)))
@@ -3787,7 +3788,7 @@ has_server_privilege_name_name(PG_FUNCTION_ARGS)
37873788
AclMode mode;
37883789
AclResult aclresult;
37893790

3790-
roleid = get_role_oid(NameStr(*username), false);
3791+
roleid = get_role_oid_or_public(NameStr(*username));
37913792
serverid = convert_server_name(servername);
37923793
mode = convert_server_priv_string(priv_type_text);
37933794

@@ -3836,7 +3837,7 @@ has_server_privilege_name_id(PG_FUNCTION_ARGS)
38363837
AclMode mode;
38373838
AclResult aclresult;
38383839

3839-
roleid = get_role_oid(NameStr(*username), false);
3840+
roleid = get_role_oid_or_public(NameStr(*username));
38403841
mode = convert_server_priv_string(priv_type_text);
38413842

38423843
aclresult = pg_foreign_server_aclcheck(serverid, roleid, mode);
@@ -3969,7 +3970,7 @@ has_tablespace_privilege_name_name(PG_FUNCTION_ARGS)
39693970
AclMode mode;
39703971
AclResult aclresult;
39713972

3972-
roleid = get_role_oid(NameStr(*username), false);
3973+
roleid = get_role_oid_or_public(NameStr(*username));
39733974
tablespaceoid = convert_tablespace_name(tablespacename);
39743975
mode = convert_tablespace_priv_string(priv_type_text);
39753976

@@ -4018,7 +4019,7 @@ has_tablespace_privilege_name_id(PG_FUNCTION_ARGS)
40184019
AclMode mode;
40194020
AclResult aclresult;
40204021

4021-
roleid = get_role_oid(NameStr(*username), false);
4022+
roleid = get_role_oid_or_public(NameStr(*username));
40224023
mode = convert_tablespace_priv_string(priv_type_text);
40234024

40244025
aclresult = pg_tablespace_aclcheck(tablespaceoid, roleid, mode);
@@ -4821,3 +4822,16 @@ get_role_oid(const char *rolname, bool missing_ok)
48214822
errmsg("role \"%s\" does not exist", rolname)));
48224823
return oid;
48234824
}
4825+
4826+
/*
4827+
* get_role_oid_or_public - As above, but return ACL_ID_PUBLIC if the
4828+
* role name is "public".
4829+
*/
4830+
static Oid
4831+
get_role_oid_or_public(const char *rolname)
4832+
{
4833+
if (strcmp(rolname, "public") == 0)
4834+
return ACL_ID_PUBLIC;
4835+
4836+
return get_role_oid(rolname, false);
4837+
}

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy