Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Commit52b927a

Browse files
committed
pg_dump: fix mis-dumping of non-global default privileges.
Non-global default privilege entries should be dumped as-is,not made relative to the default ACL for their object type.This would typically only matter if one had revoked someon-by-default privileges in a global entry, and then wantedto grant them again in a non-global entry.Per report from Boris Korzun. This is an old bug, so back-patchto all supported branches.Neil Chen, test case by Masahiko SawadaDiscussion:https://postgr.es/m/111621616618184@mail.yandex.ruDiscussion:https://postgr.es/m/CAA3qoJnr2+1dVJObNtfec=qW4Z0nz=A9+r5bZKoTSy5RDjskMw@mail.gmail.com
1 parent4048fc4 commit52b927a

File tree

2 files changed

+37
-1
lines changed

2 files changed

+37
-1
lines changed

‎src/bin/pg_dump/pg_dump.c

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9555,9 +9555,26 @@ getDefaultACLs(Archive *fout, int *numDefaultACLs)
95559555
PQExpBuffer initacl_subquery = createPQExpBuffer();
95569556
PQExpBuffer initracl_subquery = createPQExpBuffer();
95579557

9558+
/*
9559+
* Global entries (with defaclnamespace=0) replace the hard-wired
9560+
* default ACL for their object type. We should dump them as deltas
9561+
* from the default ACL, since that will be used as a starting point
9562+
* for interpreting the ALTER DEFAULT PRIVILEGES commands. On the
9563+
* other hand, non-global entries can only add privileges not revoke
9564+
* them. We must dump those as-is (i.e., as deltas from an empty
9565+
* ACL). We implement that by passing NULL as the object type for
9566+
* acldefault(), which works because acldefault() is STRICT.
9567+
*
9568+
* We can use defaclobjtype as the object type for acldefault(),
9569+
* except for the case of 'S' (DEFACLOBJ_SEQUENCE) which must be
9570+
* converted to 's'.
9571+
*/
95589572
buildACLQueries(acl_subquery, racl_subquery, initacl_subquery,
95599573
initracl_subquery, "defaclacl", "defaclrole",
9560-
"CASE WHEN defaclobjtype = 'S' THEN 's' ELSE defaclobjtype END::\"char\"",
9574+
"CASE WHEN defaclnamespace = 0 THEN"
9575+
" CASE WHEN defaclobjtype = 'S' THEN 's'::\"char\""
9576+
" ELSE defaclobjtype END "
9577+
"ELSE NULL END",
95619578
dopt->binary_upgrade);
95629579

95639580
appendPQExpBuffer(query, "SELECT d.oid, d.tableoid, "

‎src/bin/pg_dump/t/002_pg_dump.pl

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -421,6 +421,25 @@
421421
},
422422
},
423423

424+
'ALTER DEFAULT PRIVILEGES FOR ROLE regress_dump_test_role GRANT EXECUTE ON FUNCTIONS'
425+
=> {
426+
create_order=> 15,
427+
create_sql=>'ALTER DEFAULT PRIVILEGES
428+
FOR ROLE regress_dump_test_role IN SCHEMA dump_test
429+
GRANT EXECUTE ON FUNCTIONS TO regress_dump_test_role;',
430+
regexp=>qr/^
431+
\QALTER DEFAULT PRIVILEGES\E
432+
\QFOR ROLE regress_dump_test_role IN SCHEMA dump_test\E
433+
\QGRANT ALL ON FUNCTIONS TO regress_dump_test_role;\E
434+
/xm,
435+
like=>
436+
{%full_runs,%dump_test_schema_runs,section_post_data=> 1, },
437+
unlike=> {
438+
exclude_dump_test_schema=> 1,
439+
no_privs=> 1,
440+
},
441+
},
442+
424443
'ALTER DEFAULT PRIVILEGES FOR ROLE regress_dump_test_role REVOKE'=> {
425444
create_order=> 55,
426445
create_sql=>'ALTER DEFAULT PRIVILEGES

0 commit comments

Comments
 (0)

[8]ページ先頭

©2009-2025 Movatter.jp