Skip to content

Commit d0f876c

Browse files
ItGackyItGacky
committed
Accept 'public' as a pseudo-role name in has_table_privilege() and friends
to see if a particular privilege has been granted to PUBLIC. The issue was reported by Jim Nasby. Patch by Alvaro Herrera, and reviewed by KaiGai Kohei.
1 parent f4d242e commit d0f876c

File tree

2 files changed

+42
-27
lines changed

2 files changed

+42
-27
lines changed

‎doc/src/sgml/func.sgml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12348,8 +12348,8 @@ SET search_path TO <replaceable>schema</> <optional>, <replaceable>schema</>, ..
1234812348
<para>
1234912349
<function>has_table_privilege</function> checks whether a user
1235012350
can access a table in a particular way. The user can be
12351-
specified by name or by OID
12352-
(<literal>pg_authid.oid</literal>), or if the argument is
12351+
specified by name, by OID (<literal>pg_authid.oid</literal>),
12352+
<literal>public</> to indicate the PUBLIC pseudo-role, or if the argument is
1235312353
omitted
1235412354
<function>current_user</function> is assumed. The table can be specified
1235512355
by name or by OID. (Thus, there are actually six variants of
@@ -12496,7 +12496,8 @@ SELECT has_function_privilege('joeuser', 'myfunc(int, text)', 'execute');
1249612496
<function>pg_has_role</function> checks whether a user
1249712497
can access a role in a particular way.
1249812498
Its argument possibilities
12499-
are analogous to <function>has_table_privilege</function>.
12499+
are analogous to <function>has_table_privilege</function>,
12500+
except that <literal>public</> is not allowed as a user name.
1250012501
The desired access privilege type must evaluate to some combination of
1250112502
<literal>MEMBER</literal> or
1250212503
<literal>USAGE</literal>.

‎src/backend/utils/adt/acl.c‎

Lines changed: 38 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,7 @@ static AclMode convert_role_priv_string(text *priv_type_text);
113113
static AclResult pg_role_aclcheck(Oid role_oid, Oid roleid, AclMode mode);
114114

115115
static void RoleMembershipCacheCallback(Datum arg, int cacheid, ItemPointer tuplePtr);
116+
static Oid get_role_oid_or_public(const char *rolname);
116117

117118

118119
/*
@@ -1791,7 +1792,7 @@ has_table_privilege_name_name(PG_FUNCTION_ARGS)
17911792
AclMode mode;
17921793
AclResult aclresult;
17931794

1794-
roleid = get_role_oid(NameStr(*rolename), false);
1795+
roleid = get_role_oid_or_public(NameStr(*rolename));
17951796
tableoid = convert_table_name(tablename);
17961797
mode = convert_table_priv_string(priv_type_text);
17971798

@@ -1840,7 +1841,7 @@ has_table_privilege_name_id(PG_FUNCTION_ARGS)
18401841
AclMode mode;
18411842
AclResult aclresult;
18421843

1843-
roleid = get_role_oid(NameStr(*username), false);
1844+
roleid = get_role_oid_or_public(NameStr(*username));
18441845
mode = convert_table_priv_string(priv_type_text);
18451846

18461847
if (!SearchSysCacheExists1(RELOID, ObjectIdGetDatum(tableoid)))
@@ -1998,7 +1999,7 @@ has_sequence_privilege_name_name(PG_FUNCTION_ARGS)
19981999
AclMode mode;
19992000
AclResult aclresult;
20002001

2001-
roleid = get_role_oid(NameStr(*rolename), false);
2002+
roleid = get_role_oid_or_public(NameStr(*rolename));
20022003
mode = convert_sequence_priv_string(priv_type_text);
20032004
sequenceoid = convert_table_name(sequencename);
20042005
if (get_rel_relkind(sequenceoid) != RELKIND_SEQUENCE)
@@ -2058,7 +2059,7 @@ has_sequence_privilege_name_id(PG_FUNCTION_ARGS)
20582059
AclResult aclresult;
20592060
char relkind;
20602061

2061-
roleid = get_role_oid(NameStr(*username), false);
2062+
roleid = get_role_oid_or_public(NameStr(*username));
20622063
mode = convert_sequence_priv_string(priv_type_text);
20632064
relkind = get_rel_relkind(sequenceoid);
20642065
if (relkind == '\0')
@@ -2209,7 +2210,7 @@ has_any_column_privilege_name_name(PG_FUNCTION_ARGS)
22092210
AclMode mode;
22102211
AclResult aclresult;
22112212

2212-
roleid = get_role_oid(NameStr(*rolename), false);
2213+
roleid = get_role_oid_or_public(NameStr(*rolename));
22132214
tableoid = convert_table_name(tablename);
22142215
mode = convert_column_priv_string(priv_type_text);
22152216

@@ -2266,7 +2267,7 @@ has_any_column_privilege_name_id(PG_FUNCTION_ARGS)
22662267
AclMode mode;
22672268
AclResult aclresult;
22682269

2269-
roleid = get_role_oid(NameStr(*username), false);
2270+
roleid = get_role_oid_or_public(NameStr(*username));
22702271
mode = convert_column_priv_string(priv_type_text);
22712272

22722273
if (!SearchSysCacheExists1(RELOID, ObjectIdGetDatum(tableoid)))
@@ -2451,7 +2452,7 @@ has_column_privilege_name_name_name(PG_FUNCTION_ARGS)
24512452
AclMode mode;
24522453
int privresult;
24532454

2454-
roleid = get_role_oid(NameStr(*rolename), false);
2455+
roleid = get_role_oid_or_public(NameStr(*rolename));
24552456
tableoid = convert_table_name(tablename);
24562457
colattnum = convert_column_name(tableoid, column);
24572458
mode = convert_column_priv_string(priv_type_text);
@@ -2479,7 +2480,7 @@ has_column_privilege_name_name_attnum(PG_FUNCTION_ARGS)
24792480
AclMode mode;
24802481
int privresult;
24812482

2482-
roleid = get_role_oid(NameStr(*rolename), false);
2483+
roleid = get_role_oid_or_public(NameStr(*rolename));
24832484
tableoid = convert_table_name(tablename);
24842485
mode = convert_column_priv_string(priv_type_text);
24852486

@@ -2506,7 +2507,7 @@ has_column_privilege_name_id_name(PG_FUNCTION_ARGS)
25062507
AclMode mode;
25072508
int privresult;
25082509

2509-
roleid = get_role_oid(NameStr(*username), false);
2510+
roleid = get_role_oid_or_public(NameStr(*username));
25102511
colattnum = convert_column_name(tableoid, column);
25112512
mode = convert_column_priv_string(priv_type_text);
25122513

@@ -2532,7 +2533,7 @@ has_column_privilege_name_id_attnum(PG_FUNCTION_ARGS)
25322533
AclMode mode;
25332534
int privresult;
25342535

2535-
roleid = get_role_oid(NameStr(*username), false);
2536+
roleid = get_role_oid_or_public(NameStr(*username));
25362537
mode = convert_column_priv_string(priv_type_text);
25372538

25382539
privresult = column_privilege_check(tableoid, colattnum, roleid, mode);
@@ -2823,7 +2824,7 @@ has_database_privilege_name_name(PG_FUNCTION_ARGS)
28232824
AclMode mode;
28242825
AclResult aclresult;
28252826

2826-
roleid = get_role_oid(NameStr(*username), false);
2827+
roleid = get_role_oid_or_public(NameStr(*username));
28272828
databaseoid = convert_database_name(databasename);
28282829
mode = convert_database_priv_string(priv_type_text);
28292830

@@ -2872,7 +2873,7 @@ has_database_privilege_name_id(PG_FUNCTION_ARGS)
28722873
AclMode mode;
28732874
AclResult aclresult;
28742875

2875-
roleid = get_role_oid(NameStr(*username), false);
2876+
roleid = get_role_oid_or_public(NameStr(*username));
28762877
mode = convert_database_priv_string(priv_type_text);
28772878

28782879
if (!SearchSysCacheExists1(DATABASEOID, ObjectIdGetDatum(databaseoid)))
@@ -3021,7 +3022,7 @@ has_foreign_data_wrapper_privilege_name_name(PG_FUNCTION_ARGS)
30213022
AclMode mode;
30223023
AclResult aclresult;
30233024

3024-
roleid = get_role_oid(NameStr(*username), false);
3025+
roleid = get_role_oid_or_public(NameStr(*username));
30253026
fdwid = convert_foreign_data_wrapper_name(fdwname);
30263027
mode = convert_foreign_data_wrapper_priv_string(priv_type_text);
30273028

@@ -3070,7 +3071,7 @@ has_foreign_data_wrapper_privilege_name_id(PG_FUNCTION_ARGS)
30703071
AclMode mode;
30713072
AclResult aclresult;
30723073

3073-
roleid = get_role_oid(NameStr(*username), false);
3074+
roleid = get_role_oid_or_public(NameStr(*username));
30743075
mode = convert_foreign_data_wrapper_priv_string(priv_type_text);
30753076

30763077
aclresult = pg_foreign_data_wrapper_aclcheck(fdwid, roleid, mode);
@@ -3203,7 +3204,7 @@ has_function_privilege_name_name(PG_FUNCTION_ARGS)
32033204
AclMode mode;
32043205
AclResult aclresult;
32053206

3206-
roleid = get_role_oid(NameStr(*username), false);
3207+
roleid = get_role_oid_or_public(NameStr(*username));
32073208
functionoid = convert_function_name(functionname);
32083209
mode = convert_function_priv_string(priv_type_text);
32093210

@@ -3252,7 +3253,7 @@ has_function_privilege_name_id(PG_FUNCTION_ARGS)
32523253
AclMode mode;
32533254
AclResult aclresult;
32543255

3255-
roleid = get_role_oid(NameStr(*username), false);
3256+
roleid = get_role_oid_or_public(NameStr(*username));
32563257
mode = convert_function_priv_string(priv_type_text);
32573258

32583259
if (!SearchSysCacheExists1(PROCOID, ObjectIdGetDatum(functionoid)))
@@ -3403,7 +3404,7 @@ has_language_privilege_name_name(PG_FUNCTION_ARGS)
34033404
AclMode mode;
34043405
AclResult aclresult;
34053406

3406-
roleid = get_role_oid(NameStr(*username), false);
3407+
roleid = get_role_oid_or_public(NameStr(*username));
34073408
languageoid = convert_language_name(languagename);
34083409
mode = convert_language_priv_string(priv_type_text);
34093410

@@ -3452,7 +3453,7 @@ has_language_privilege_name_id(PG_FUNCTION_ARGS)
34523453
AclMode mode;
34533454
AclResult aclresult;
34543455

3455-
roleid = get_role_oid(NameStr(*username), false);
3456+
roleid = get_role_oid_or_public(NameStr(*username));
34563457
mode = convert_language_priv_string(priv_type_text);
34573458

34583459
if (!SearchSysCacheExists1(LANGOID, ObjectIdGetDatum(languageoid)))
@@ -3594,7 +3595,7 @@ has_schema_privilege_name_name(PG_FUNCTION_ARGS)
35943595
AclMode mode;
35953596
AclResult aclresult;
35963597

3597-
roleid = get_role_oid(NameStr(*username), false);
3598+
roleid = get_role_oid_or_public(NameStr(*username));
35983599
schemaoid = convert_schema_name(schemaname);
35993600
mode = convert_schema_priv_string(priv_type_text);
36003601

@@ -3643,7 +3644,7 @@ has_schema_privilege_name_id(PG_FUNCTION_ARGS)
36433644
AclMode mode;
36443645
AclResult aclresult;
36453646

3646-
roleid = get_role_oid(NameStr(*username), false);
3647+
roleid = get_role_oid_or_public(NameStr(*username));
36473648
mode = convert_schema_priv_string(priv_type_text);
36483649

36493650
if (!SearchSysCacheExists1(NAMESPACEOID, ObjectIdGetDatum(schemaoid)))
@@ -3787,7 +3788,7 @@ has_server_privilege_name_name(PG_FUNCTION_ARGS)
37873788
AclMode mode;
37883789
AclResult aclresult;
37893790

3790-
roleid = get_role_oid(NameStr(*username), false);
3791+
roleid = get_role_oid_or_public(NameStr(*username));
37913792
serverid = convert_server_name(servername);
37923793
mode = convert_server_priv_string(priv_type_text);
37933794

@@ -3836,7 +3837,7 @@ has_server_privilege_name_id(PG_FUNCTION_ARGS)
38363837
AclMode mode;
38373838
AclResult aclresult;
38383839

3839-
roleid = get_role_oid(NameStr(*username), false);
3840+
roleid = get_role_oid_or_public(NameStr(*username));
38403841
mode = convert_server_priv_string(priv_type_text);
38413842

38423843
aclresult = pg_foreign_server_aclcheck(serverid, roleid, mode);
@@ -3969,7 +3970,7 @@ has_tablespace_privilege_name_name(PG_FUNCTION_ARGS)
39693970
AclMode mode;
39703971
AclResult aclresult;
39713972

3972-
roleid = get_role_oid(NameStr(*username), false);
3973+
roleid = get_role_oid_or_public(NameStr(*username));
39733974
tablespaceoid = convert_tablespace_name(tablespacename);
39743975
mode = convert_tablespace_priv_string(priv_type_text);
39753976

@@ -4018,7 +4019,7 @@ has_tablespace_privilege_name_id(PG_FUNCTION_ARGS)
40184019
AclMode mode;
40194020
AclResult aclresult;
40204021

4021-
roleid = get_role_oid(NameStr(*username), false);
4022+
roleid = get_role_oid_or_public(NameStr(*username));
40224023
mode = convert_tablespace_priv_string(priv_type_text);
40234024

40244025
aclresult = pg_tablespace_aclcheck(tablespaceoid, roleid, mode);
@@ -4821,3 +4822,16 @@ get_role_oid(const char *rolname, bool missing_ok)
48214822
errmsg("role \"%s\" does not exist", rolname)));
48224823
return oid;
48234824
}
4825+
4826+
/*
4827+
* get_role_oid_or_public - As above, but return ACL_ID_PUBLIC if the
4828+
* role name is "public".
4829+
*/
4830+
static Oid
4831+
get_role_oid_or_public(const char *rolname)
4832+
{
4833+
if (strcmp(rolname, "public") == 0)
4834+
return ACL_ID_PUBLIC;
4835+
4836+
return get_role_oid(rolname, false);
4837+
}

0 commit comments

Comments
 (0)