Horton

Add permission check for MERGE/SPLIT partition operations

Alexander Korotkov <akorotkov@postgresql.org>

View on postgr.es
Commit: 3ca43dbbb67fbfb96dec8de2e268b96790555148
Author: Alexander Korotkov <akorotkov@postgresql.org>
Date: 2024-05-12T21:00:21Z
Releases: 17.0 
Add permission check for MERGE/SPLIT partition operations

Currently, we check only owner permission for the parent table before
MERGE/SPLIT partition operations.  This leads to a security hole when users
can get access to the data of partitions without permission.  This commit
fixes this problem by requiring owner permission on all the partitions
involved.

Reported-by: Alexander Lakhin
Discussion: https://postgr.es/m/0520c72e-8d97-245e-53f9-173beca2ab2e%40gmail.com
Author: Dmitry Koval, Alexander Korotkov

Files

PathChange+/−
src/backend/parser/parse_utilcmd.c modified +5 −0
src/test/regress/expected/partition_merge.out modified +29 −0
src/test/regress/expected/partition_split.out modified +29 −0
src/test/regress/sql/partition_merge.sql modified +33 −0
src/test/regress/sql/partition_split.sql modified +33 −0

Discussion