diff options
| author | Alvaro Herrera <alvherre@alvh.no-ip.org> | 2024-02-21 17:18:52 +0100 |
|---|---|---|
| committer | Alvaro Herrera <alvherre@alvh.no-ip.org> | 2024-02-21 17:18:52 +0100 |
| commit | a3f5d2056ceba95d94607be3138fa52499a957e6 (patch) | |
| tree | 26e2103b2e9b34d73c784ff1d2f2700137af4b1d /src/backend/parser/parse_merge.c | |
| parent | 21d521ded33fdc9901cba7e8ecb3e03003007845 (diff) | |
| download | postgresql-a3f5d2056ceba95d94607be3138fa52499a957e6.tar.gz postgresql-a3f5d2056ceba95d94607be3138fa52499a957e6.zip | |
MERGE ... DO NOTHING: require SELECT privileges
Verify that a user running MERGE with a DO NOTHING clause has
privileges to read the table, even if no columns are referenced. Such
privileges were already required if the ON clause or any of the WHEN
conditions referenced any column at all, so there's no functional change
in practice.
This change fixes an assertion failure in the case where no column is
referenced by the command and the WHEN clauses are all DO NOTHING.
Backpatch to 15, where MERGE was introduced.
Reported-by: Alena Rybakina <a.rybakina@postgrespro.ru>
Reported-by: Alexander Lakhin <exclusion@gmail.com>
Discussion: https://postgr.es/m/4d65a385-7efa-4436-a825-0869f89d9d92@postgrespro.ru
Diffstat (limited to 'src/backend/parser/parse_merge.c')
| -rw-r--r-- | src/backend/parser/parse_merge.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/backend/parser/parse_merge.c b/src/backend/parser/parse_merge.c index 91b1156d991..bf624666088 100644 --- a/src/backend/parser/parse_merge.c +++ b/src/backend/parser/parse_merge.c @@ -133,7 +133,11 @@ transformMergeStmt(ParseState *pstate, MergeStmt *stmt) int when_type = (mergeWhenClause->matched ? 0 : 1); /* - * Collect action types so we can check target permissions + * Collect permissions to check, according to action types. We require + * SELECT privileges for DO NOTHING because it'd be irregular to have + * a target relation with zero privileges checked, in case DO NOTHING + * is the only action. There's no damage from that: any meaningful + * MERGE command requires at least some access to the table anyway. */ switch (mergeWhenClause->commandType) { @@ -147,6 +151,7 @@ transformMergeStmt(ParseState *pstate, MergeStmt *stmt) targetPerms |= ACL_DELETE; break; case CMD_NOTHING: + targetPerms |= ACL_SELECT; break; default: elog(ERROR, "unknown action in MERGE WHEN clause"); |