Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit4760060

Browse files
committed
pg_dump: fix mis-dumping of non-global default privileges.
Non-global default privilege entries should be dumped as-is,not made relative to the default ACL for their object type.This would typically only matter if one had revoked someon-by-default privileges in a global entry, and then wantedto grant them again in a non-global entry.Per report from Boris Korzun. This is an old bug, so back-patchto all supported branches.Neil Chen, test case by Masahiko SawadaDiscussion:https://postgr.es/m/111621616618184@mail.yandex.ruDiscussion:https://postgr.es/m/CAA3qoJnr2+1dVJObNtfec=qW4Z0nz=A9+r5bZKoTSy5RDjskMw@mail.gmail.com
1 parent23469b8 commit4760060

File tree

2 files changed

+37
-1
lines changed

2 files changed

+37
-1
lines changed

‎src/bin/pg_dump/pg_dump.c

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9675,9 +9675,26 @@ getDefaultACLs(Archive *fout, int *numDefaultACLs)
96759675
PQExpBuffer initacl_subquery = createPQExpBuffer();
96769676
PQExpBuffer initracl_subquery = createPQExpBuffer();
96779677

9678+
/*
9679+
* Global entries (with defaclnamespace=0) replace the hard-wired
9680+
* default ACL for their object type. We should dump them as deltas
9681+
* from the default ACL, since that will be used as a starting point
9682+
* for interpreting the ALTER DEFAULT PRIVILEGES commands. On the
9683+
* other hand, non-global entries can only add privileges not revoke
9684+
* them. We must dump those as-is (i.e., as deltas from an empty
9685+
* ACL). We implement that by passing NULL as the object type for
9686+
* acldefault(), which works because acldefault() is STRICT.
9687+
*
9688+
* We can use defaclobjtype as the object type for acldefault(),
9689+
* except for the case of 'S' (DEFACLOBJ_SEQUENCE) which must be
9690+
* converted to 's'.
9691+
*/
96789692
buildACLQueries(acl_subquery, racl_subquery, initacl_subquery,
96799693
initracl_subquery, "defaclacl", "defaclrole",
9680-
"CASE WHEN defaclobjtype = 'S' THEN 's' ELSE defaclobjtype END::\"char\"",
9694+
"CASE WHEN defaclnamespace = 0 THEN"
9695+
" CASE WHEN defaclobjtype = 'S' THEN 's'::\"char\""
9696+
" ELSE defaclobjtype END "
9697+
"ELSE NULL END",
96819698
dopt->binary_upgrade);
96829699

96839700
appendPQExpBuffer(query, "SELECT d.oid, d.tableoid, "

‎src/bin/pg_dump/t/002_pg_dump.pl

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -421,6 +421,25 @@
421421
},
422422
},
423423

424+
'ALTER DEFAULT PRIVILEGES FOR ROLE regress_dump_test_role GRANT EXECUTE ON FUNCTIONS'
425+
=> {
426+
create_order=> 15,
427+
create_sql=>'ALTER DEFAULT PRIVILEGES
428+
FOR ROLE regress_dump_test_role IN SCHEMA dump_test
429+
GRANT EXECUTE ON FUNCTIONS TO regress_dump_test_role;',
430+
regexp=>qr/^
431+
\QALTER DEFAULT PRIVILEGES\E
432+
\QFOR ROLE regress_dump_test_role IN SCHEMA dump_test\E
433+
\QGRANT ALL ON FUNCTIONS TO regress_dump_test_role;\E
434+
/xm,
435+
like=>
436+
{%full_runs,%dump_test_schema_runs,section_post_data=> 1, },
437+
unlike=> {
438+
exclude_dump_test_schema=> 1,
439+
no_privs=> 1,
440+
},
441+
},
442+
424443
'ALTER DEFAULT PRIVILEGES FOR ROLE regress_dump_test_role REVOKE'=> {
425444
create_order=> 55,
426445
create_sql=>'ALTER DEFAULT PRIVILEGES

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp