diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2017-02-13 08:57:45 -0500 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2017-03-22 11:19:30 -0400 |
| commit | 4cfc9484d4effb0a3aa2c8742bdef0c2bc7a3ca5 (patch) | |
| tree | abc5444ab89b758b14cf86d3db21d79f0b7852af /src | |
| parent | 96a7128b7b4c9ce4fb51df8c8b216dfab6340766 (diff) | |
| download | postgresql-4cfc9484d4effb0a3aa2c8742bdef0c2bc7a3ca5.tar.gz postgresql-4cfc9484d4effb0a3aa2c8742bdef0c2bc7a3ca5.zip | |
Refine rules for altering publication owner
Previously, the new owner had to be a superuser. The new rules are more
refined similar to other objects.
Reviewed-by: Petr Jelinek <petr.jelinek@2ndquadrant.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/backend/commands/publicationcmds.c | 34 | ||||
| -rw-r--r-- | src/test/regress/expected/publication.out | 8 | ||||
| -rw-r--r-- | src/test/regress/sql/publication.sql | 4 |
3 files changed, 36 insertions, 10 deletions
diff --git a/src/backend/commands/publicationcmds.c b/src/backend/commands/publicationcmds.c index 04f83e0a2ea..d69e39dc5b4 100644 --- a/src/backend/commands/publicationcmds.c +++ b/src/backend/commands/publicationcmds.c @@ -670,17 +670,31 @@ AlterPublicationOwner_internal(Relation rel, HeapTuple tup, Oid newOwnerId) if (form->pubowner == newOwnerId) return; - if (!pg_publication_ownercheck(HeapTupleGetOid(tup), GetUserId())) - aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_PUBLICATION, - NameStr(form->pubname)); + if (!superuser()) + { + AclResult aclresult; - /* New owner must be a superuser */ - if (!superuser_arg(newOwnerId)) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - errmsg("permission denied to change owner of publication \"%s\"", - NameStr(form->pubname)), - errhint("The owner of a publication must be a superuser."))); + /* Must be owner */ + if (!pg_publication_ownercheck(HeapTupleGetOid(tup), GetUserId())) + aclcheck_error(ACLCHECK_NOT_OWNER, ACL_KIND_PUBLICATION, + NameStr(form->pubname)); + + /* Must be able to become new owner */ + check_is_member_of_role(GetUserId(), newOwnerId); + + /* New owner must have CREATE privilege on database */ + aclresult = pg_database_aclcheck(MyDatabaseId, newOwnerId, ACL_CREATE); + if (aclresult != ACLCHECK_OK) + aclcheck_error(aclresult, ACL_KIND_DATABASE, + get_database_name(MyDatabaseId)); + + if (form->puballtables && !superuser_arg(newOwnerId)) + ereport(ERROR, + (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), + errmsg("permission denied to change owner of publication \"%s\"", + NameStr(form->pubname)), + errhint("The owner of a FOR ALL TABLES publication must be a superuser."))); + } form->pubowner = newOwnerId; CatalogTupleUpdate(rel, &tup->t_self, tup); diff --git a/src/test/regress/expected/publication.out b/src/test/regress/expected/publication.out index 7c4834b213c..5a7c0edf7d5 100644 --- a/src/test/regress/expected/publication.out +++ b/src/test/regress/expected/publication.out @@ -182,6 +182,14 @@ ALTER PUBLICATION testpub_default RENAME TO testpub_foo; -- rename back to keep the rest simple ALTER PUBLICATION testpub_foo RENAME TO testpub_default; +ALTER PUBLICATION testpub_default OWNER TO regress_publication_user2; +\dRp testpub_default + List of publications + Name | Owner | Inserts | Updates | Deletes +-----------------+---------------------------+---------+---------+--------- + testpub_default | regress_publication_user2 | t | t | t +(1 row) + DROP PUBLICATION testpub_default; DROP PUBLICATION testpib_ins_trunct; DROP PUBLICATION testpub_fortbl; diff --git a/src/test/regress/sql/publication.sql b/src/test/regress/sql/publication.sql index 46d275acc59..cff9931a77f 100644 --- a/src/test/regress/sql/publication.sql +++ b/src/test/regress/sql/publication.sql @@ -108,6 +108,10 @@ ALTER PUBLICATION testpub_default RENAME TO testpub_foo; -- rename back to keep the rest simple ALTER PUBLICATION testpub_foo RENAME TO testpub_default; +ALTER PUBLICATION testpub_default OWNER TO regress_publication_user2; + +\dRp testpub_default + DROP PUBLICATION testpub_default; DROP PUBLICATION testpib_ins_trunct; DROP PUBLICATION testpub_fortbl; |