Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Commit3ad2c24

Browse files
committed
pg_dump: fix mis-dumping of non-global default privileges.
Non-global default privilege entries should be dumped as-is,not made relative to the default ACL for their object type.This would typically only matter if one had revoked someon-by-default privileges in a global entry, and then wantedto grant them again in a non-global entry.Per report from Boris Korzun. This is an old bug, so back-patchto all supported branches.Neil Chen, test case by Masahiko SawadaDiscussion:https://postgr.es/m/111621616618184@mail.yandex.ruDiscussion:https://postgr.es/m/CAA3qoJnr2+1dVJObNtfec=qW4Z0nz=A9+r5bZKoTSy5RDjskMw@mail.gmail.com
1 parent52c0c11 commit3ad2c24

File tree

2 files changed

+37
-1
lines changed

2 files changed

+37
-1
lines changed

‎src/bin/pg_dump/pg_dump.c‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9787,9 +9787,26 @@ getDefaultACLs(Archive *fout, int *numDefaultACLs)
97879787
PQExpBuffer initacl_subquery = createPQExpBuffer();
97889788
PQExpBuffer initracl_subquery = createPQExpBuffer();
97899789

9790+
/*
9791+
* Global entries (with defaclnamespace=0) replace the hard-wired
9792+
* default ACL for their object type. We should dump them as deltas
9793+
* from the default ACL, since that will be used as a starting point
9794+
* for interpreting the ALTER DEFAULT PRIVILEGES commands. On the
9795+
* other hand, non-global entries can only add privileges not revoke
9796+
* them. We must dump those as-is (i.e., as deltas from an empty
9797+
* ACL). We implement that by passing NULL as the object type for
9798+
* acldefault(), which works because acldefault() is STRICT.
9799+
*
9800+
* We can use defaclobjtype as the object type for acldefault(),
9801+
* except for the case of 'S' (DEFACLOBJ_SEQUENCE) which must be
9802+
* converted to 's'.
9803+
*/
97909804
buildACLQueries(acl_subquery, racl_subquery, initacl_subquery,
97919805
initracl_subquery, "defaclacl", "defaclrole",
9792-
"CASE WHEN defaclobjtype = 'S' THEN 's' ELSE defaclobjtype END::\"char\"",
9806+
"CASE WHEN defaclnamespace = 0 THEN"
9807+
" CASE WHEN defaclobjtype = 'S' THEN 's'::\"char\""
9808+
" ELSE defaclobjtype END "
9809+
"ELSE NULL END",
97939810
dopt->binary_upgrade);
97949811

97959812
appendPQExpBuffer(query, "SELECT d.oid, d.tableoid, "

‎src/bin/pg_dump/t/002_pg_dump.pl‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -436,6 +436,25 @@
436436
},
437437
},
438438

439+
'ALTER DEFAULT PRIVILEGES FOR ROLE regress_dump_test_role GRANT EXECUTE ON FUNCTIONS'
440+
=> {
441+
create_order=> 15,
442+
create_sql=>'ALTER DEFAULT PRIVILEGES
443+
FOR ROLE regress_dump_test_role IN SCHEMA dump_test
444+
GRANT EXECUTE ON FUNCTIONS TO regress_dump_test_role;',
445+
regexp=>qr/^
446+
\QALTER DEFAULT PRIVILEGES\E
447+
\QFOR ROLE regress_dump_test_role IN SCHEMA dump_test\E
448+
\QGRANT ALL ON FUNCTIONS TO regress_dump_test_role;\E
449+
/xm,
450+
like=>
451+
{%full_runs,%dump_test_schema_runs,section_post_data=> 1, },
452+
unlike=> {
453+
exclude_dump_test_schema=> 1,
454+
no_privs=> 1,
455+
},
456+
},
457+
439458
'ALTER DEFAULT PRIVILEGES FOR ROLE regress_dump_test_role REVOKE'=> {
440459
create_order=> 55,
441460
create_sql=>'ALTER DEFAULT PRIVILEGES

0 commit comments

Comments
 (0)

[8]ページ先頭

©2009-2025 Movatter.jp