Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commita912a27

Browse files
committed
Creator of a range type must have permission to call support functions.
Since range types can be created by non-superusers, we need to considertheir permissions. Ideally we'd check this when the type is used, notwhen it's created, but that seems like much more trouble than it's worth.The existing restriction that the support functions be immutable alreadyprevents most cases where an unauthorized call to a function might bethought a security issue, and the fact that the user has no access tothe results of the system's calls to subtype_diff closes off the otherplausible reason for concern. So this check is basically pro-forma,but let's make it anyway.
1 parent74c1723 commita912a27

File tree

1 file changed

+12
-0
lines changed

1 file changed

+12
-0
lines changed

‎src/backend/commands/typecmds.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1853,6 +1853,7 @@ findRangeCanonicalFunction(List *procname, Oid typeOid)
18531853
{
18541854
OidargList[1];
18551855
OidprocOid;
1856+
AclResultaclresult;
18561857

18571858
/*
18581859
* Range canonical functions must take and return the range type, and must
@@ -1880,6 +1881,11 @@ findRangeCanonicalFunction(List *procname, Oid typeOid)
18801881
errmsg("range canonical function %s must be immutable",
18811882
func_signature_string(procname,1,NIL,argList))));
18821883

1884+
/* Also, range type's creator must have permission to call function */
1885+
aclresult=pg_proc_aclcheck(procOid,GetUserId(),ACL_EXECUTE);
1886+
if (aclresult!=ACLCHECK_OK)
1887+
aclcheck_error(aclresult,ACL_KIND_PROC,get_func_name(procOid));
1888+
18831889
returnprocOid;
18841890
}
18851891

@@ -1888,6 +1894,7 @@ findRangeSubtypeDiffFunction(List *procname, Oid subtype)
18881894
{
18891895
OidargList[2];
18901896
OidprocOid;
1897+
AclResultaclresult;
18911898

18921899
/*
18931900
* Range subtype diff functions must take two arguments of the subtype,
@@ -1916,6 +1923,11 @@ findRangeSubtypeDiffFunction(List *procname, Oid subtype)
19161923
errmsg("range subtype diff function %s must be immutable",
19171924
func_signature_string(procname,2,NIL,argList))));
19181925

1926+
/* Also, range type's creator must have permission to call function */
1927+
aclresult=pg_proc_aclcheck(procOid,GetUserId(),ACL_EXECUTE);
1928+
if (aclresult!=ACLCHECK_OK)
1929+
aclcheck_error(aclresult,ACL_KIND_PROC,get_func_name(procOid));
1930+
19191931
returnprocOid;
19201932
}
19211933

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp