Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit2acc84c

Browse files
committed
pg_dump: fix mis-dumping of non-global default privileges.
Non-global default privilege entries should be dumped as-is,not made relative to the default ACL for their object type.This would typically only matter if one had revoked someon-by-default privileges in a global entry, and then wantedto grant them again in a non-global entry.Per report from Boris Korzun. This is an old bug, so back-patchto all supported branches.Neil Chen, test case by Masahiko SawadaDiscussion:https://postgr.es/m/111621616618184@mail.yandex.ruDiscussion:https://postgr.es/m/CAA3qoJnr2+1dVJObNtfec=qW4Z0nz=A9+r5bZKoTSy5RDjskMw@mail.gmail.com
1 parentf4ce6c4 commit2acc84c

File tree

2 files changed

+37
-1
lines changed

2 files changed

+37
-1
lines changed

‎src/bin/pg_dump/pg_dump.c

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9562,10 +9562,27 @@ getDefaultACLs(Archive *fout, int *numDefaultACLs)
95629562
PQExpBuffer initacl_subquery = createPQExpBuffer();
95639563
PQExpBuffer initracl_subquery = createPQExpBuffer();
95649564

9565+
/*
9566+
* Global entries (with defaclnamespace=0) replace the hard-wired
9567+
* default ACL for their object type. We should dump them as deltas
9568+
* from the default ACL, since that will be used as a starting point
9569+
* for interpreting the ALTER DEFAULT PRIVILEGES commands. On the
9570+
* other hand, non-global entries can only add privileges not revoke
9571+
* them. We must dump those as-is (i.e., as deltas from an empty
9572+
* ACL). We implement that by passing NULL as the object type for
9573+
* acldefault(), which works because acldefault() is STRICT.
9574+
*
9575+
* We can use defaclobjtype as the object type for acldefault(),
9576+
* except for the case of 'S' (DEFACLOBJ_SEQUENCE) which must be
9577+
* converted to 's'.
9578+
*/
95659579
buildACLQueries(acl_subquery, racl_subquery, initacl_subquery,
95669580
initracl_subquery, "defaclacl", "defaclrole",
95679581
"pip.initprivs",
9568-
"CASE WHEN defaclobjtype = 'S' THEN 's' ELSE defaclobjtype END::\"char\"",
9582+
"CASE WHEN defaclnamespace = 0 THEN"
9583+
" CASE WHEN defaclobjtype = 'S' THEN 's'::\"char\""
9584+
" ELSE defaclobjtype END "
9585+
"ELSE NULL END",
95699586
dopt->binary_upgrade);
95709587

95719588
appendPQExpBuffer(query, "SELECT d.oid, d.tableoid, "

‎src/bin/pg_dump/t/002_pg_dump.pl

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -443,6 +443,25 @@
443443
},
444444
},
445445

446+
'ALTER DEFAULT PRIVILEGES FOR ROLE regress_dump_test_role GRANT EXECUTE ON FUNCTIONS'
447+
=> {
448+
create_order=> 15,
449+
create_sql=>'ALTER DEFAULT PRIVILEGES
450+
FOR ROLE regress_dump_test_role IN SCHEMA dump_test
451+
GRANT EXECUTE ON FUNCTIONS TO regress_dump_test_role;',
452+
regexp=>qr/^
453+
\QALTER DEFAULT PRIVILEGES\E
454+
\QFOR ROLE regress_dump_test_role IN SCHEMA dump_test\E
455+
\QGRANT ALL ON FUNCTIONS TO regress_dump_test_role;\E
456+
/xm,
457+
like=>
458+
{%full_runs,%dump_test_schema_runs,section_post_data=> 1, },
459+
unlike=> {
460+
exclude_dump_test_schema=> 1,
461+
no_privs=> 1,
462+
},
463+
},
464+
446465
'ALTER DEFAULT PRIVILEGES FOR ROLE regress_dump_test_role REVOKE'=> {
447466
create_order=> 55,
448467
create_sql=>'ALTER DEFAULT PRIVILEGES

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp