From f8a54e936bdf4c31b395a2ab7d7bc98eefa6dbad Mon Sep 17 00:00:00 2001 From: Robert Haas Date: Fri, 12 Apr 2013 08:55:56 -0400 Subject: sepgsql: Enforce db_procedure:{execute} permission. To do this, we add an additional object access hook type, OAT_FUNCTION_EXECUTE. KaiGai Kohei --- src/backend/executor/execQual.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'src/backend/executor/execQual.c') diff --git a/src/backend/executor/execQual.c b/src/backend/executor/execQual.c index 62d27a75747..330d889eba9 100644 --- a/src/backend/executor/execQual.c +++ b/src/backend/executor/execQual.c @@ -39,6 +39,7 @@ #include "access/htup_details.h" #include "access/nbtree.h" #include "access/tupconvert.h" +#include "catalog/objectaccess.h" #include "catalog/pg_type.h" #include "commands/typecmds.h" #include "executor/execdebug.h" @@ -1289,6 +1290,7 @@ init_fcache(Oid foid, Oid input_collation, FuncExprState *fcache, aclresult = pg_proc_aclcheck(foid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, ACL_KIND_PROC, get_func_name(foid)); + InvokeFunctionExecuteHook(foid); /* * Safety check on nargs. Under normal circumstances this should never @@ -4223,6 +4225,7 @@ ExecEvalArrayCoerceExpr(ArrayCoerceExprState *astate, if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, ACL_KIND_PROC, get_func_name(acoerce->elemfuncid)); + InvokeFunctionExecuteHook(acoerce->elemfuncid); /* Set up the primary fmgr lookup information */ fmgr_info_cxt(acoerce->elemfuncid, &(astate->elemfunc), -- cgit v1.2.3