diff options
| author | Nathan Bossart <nathan@postgresql.org> | 2025-01-09 17:10:13 -0600 |
|---|---|---|
| committer | Nathan Bossart <nathan@postgresql.org> | 2025-01-09 17:10:13 -0600 |
| commit | 39e3bcae44868734504c3decbb6708c36a5a84b2 (patch) | |
| tree | 0bb66ff8de3c46f005999ce322b4600055d575cc /src/backend/commands/user.c | |
| parent | bebe9040388bb2292585eab712fe4d29a71843fb (diff) | |
| download | postgresql-39e3bcae44868734504c3decbb6708c36a5a84b2.tar.gz postgresql-39e3bcae44868734504c3decbb6708c36a5a84b2.zip | |
Fix an ALTER GROUP ... DROP USER error message.
This error message stated the privileges required to add a member
to a group even if the user was trying to drop a member:
postgres=> alter group a drop user b;
ERROR: permission denied to alter role
DETAIL: Only roles with the ADMIN option on role "a" may add members.
Since the required privileges for both operations are the same, we
can fix this by modifying the message to mention both adding and
dropping members:
postgres=> alter group a drop user b;
ERROR: permission denied to alter role
DETAIL: Only roles with the ADMIN option on role "a" may add or drop members.
Author: ChangAo Chen
Reviewed-by: Tom Lane
Discussion: https://postgr.es/m/tencent_FAA0D00E3514AAF0BBB6322542A6094FEF05%40qq.com
Backpatch-through: 16
Diffstat (limited to 'src/backend/commands/user.c')
| -rw-r--r-- | src/backend/commands/user.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/backend/commands/user.c b/src/backend/commands/user.c index 266635d5e29..0db174e6f10 100644 --- a/src/backend/commands/user.c +++ b/src/backend/commands/user.c @@ -817,12 +817,12 @@ AlterRole(ParseState *pstate, AlterRoleStmt *stmt) "BYPASSRLS", "BYPASSRLS"))); } - /* To add members to a role, you need ADMIN OPTION. */ + /* To add or drop members, you need ADMIN OPTION. */ if (drolemembers && !is_admin_of_role(currentUserId, roleid)) ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), errmsg("permission denied to alter role"), - errdetail("Only roles with the %s option on role \"%s\" may add members.", + errdetail("Only roles with the %s option on role \"%s\" may add or drop members.", "ADMIN", rolename))); /* Convert validuntil to internal form */ |