Horton

Re: leaky views, yet again

Robert Haas <robertmhaas@gmail.com>

View thread
From: Robert Haas <robertmhaas@gmail.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: KaiGai Kohei <kaigai@kaigai.gr.jp>, KaiGai Kohei <kaigai@ak.jp.nec.com>, Itagaki Takahiro <itagaki.takahiro@gmail.com>, Heikki Linnakangas <heikki.linnakangas@enterprisedb.com>, pgsql-hackers@postgresql.org
Date: 2010-10-05T17:03:45Z
Lists: pgsql-hackers 
On Tue, Oct 5, 2010 at 12:27 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> Option #1: Remove all mention from the documentation of using views
>> for security purposes.  Don't allow views to have explicit permissions
>> attached to them; they are merely shorthand for a SELECT, for which
>> you either do or do not have privileges.
>
> The SQL standard requires us to attach permissions to views.  The
> standard makes no claims whatsoever about how leak-proof views should
> be; it only says that you can't call a view without the appropriate
> permissions.
>
> I do think it's reasonable for the docs to point out that views that do
> row-filtering should not be presumed to be absolutely bulletproof.
> That doesn't make permissions on them useless, so you're attacking a
> straw man.

Really?  I'm confused.  What is the use case for the status quo?

-- 
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise Postgres Company