Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitc559f61

Browse files
Fix an ALTER GROUP ... DROP USER error message.
This error message stated the privileges required to add a memberto a group even if the user was trying to drop a member:postgres=> alter group a drop user b;ERROR: permission denied to alter roleDETAIL: Only roles with the ADMIN option on role "a" may add members.Since the required privileges for both operations are the same, wecan fix this by modifying the message to mention both adding anddropping members:postgres=> alter group a drop user b;ERROR: permission denied to alter roleDETAIL: Only roles with the ADMIN option on role "a" may add or drop members.Author: ChangAo ChenReviewed-by: Tom LaneDiscussion:https://postgr.es/m/tencent_FAA0D00E3514AAF0BBB6322542A6094FEF05%40qq.comBackpatch-through: 16
1 parentffd9b81 commitc559f61

File tree

3 files changed

+12
-2
lines changed

3 files changed

+12
-2
lines changed

‎src/backend/commands/user.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -817,12 +817,12 @@ AlterRole(ParseState *pstate, AlterRoleStmt *stmt)
817817
"BYPASSRLS","BYPASSRLS")));
818818
}
819819

820-
/* To addmembers to a role, you need ADMIN OPTION. */
820+
/* To addor drop members, you need ADMIN OPTION. */
821821
if (drolemembers&& !is_admin_of_role(currentUserId,roleid))
822822
ereport(ERROR,
823823
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
824824
errmsg("permission denied to alter role"),
825-
errdetail("Only roles with the %s option on role \"%s\" may add members.",
825+
errdetail("Only roles with the %s option on role \"%s\" may addor dropmembers.",
826826
"ADMIN",rolename)));
827827

828828
/* Convert validuntil to internal form */

‎src/test/regress/expected/privileges.out

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,13 @@ CREATE GROUP regress_priv_group1;
216216
CREATE GROUP regress_priv_group2 WITH ADMIN regress_priv_user1 USER regress_priv_user2;
217217
ALTER GROUP regress_priv_group1 ADD USER regress_priv_user4;
218218
GRANT regress_priv_group2 TO regress_priv_user2 GRANTED BY regress_priv_user1;
219+
SET SESSION AUTHORIZATION regress_priv_user3;
220+
ALTER GROUP regress_priv_group2 ADD USER regress_priv_user2;-- fail
221+
ERROR: permission denied to alter role
222+
DETAIL: Only roles with the ADMIN option on role "regress_priv_group2" may add or drop members.
223+
ALTER GROUP regress_priv_group2 DROP USER regress_priv_user2;-- fail
224+
ERROR: permission denied to alter role
225+
DETAIL: Only roles with the ADMIN option on role "regress_priv_group2" may add or drop members.
219226
SET SESSION AUTHORIZATION regress_priv_user1;
220227
ALTER GROUP regress_priv_group2 ADD USER regress_priv_user2;
221228
NOTICE: role "regress_priv_user2" has already been granted membership in role "regress_priv_group2" by role "regress_priv_user1"

‎src/test/regress/sql/privileges.sql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,9 @@ CREATE GROUP regress_priv_group2 WITH ADMIN regress_priv_user1 USER regress_priv
169169
ALTERGROUP regress_priv_group1 ADD USER regress_priv_user4;
170170

171171
GRANT regress_priv_group2 TO regress_priv_user2 GRANTED BY regress_priv_user1;
172+
SET SESSION AUTHORIZATION regress_priv_user3;
173+
ALTERGROUP regress_priv_group2 ADD USER regress_priv_user2;-- fail
174+
ALTERGROUP regress_priv_group2 DROP USER regress_priv_user2;-- fail
172175
SET SESSION AUTHORIZATION regress_priv_user1;
173176
ALTERGROUP regress_priv_group2 ADD USER regress_priv_user2;
174177
ALTERGROUP regress_priv_group2 ADD USER regress_priv_user2;-- duplicate

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp