diff options
| author | Stephen Frost <sfrost@snowman.net> | 2014-11-27 01:06:36 -0500 |
|---|---|---|
| committer | Stephen Frost <sfrost@snowman.net> | 2014-11-27 01:15:57 -0500 |
| commit | 143b39c1855f8a22f474f20354ee5ee5d2f4d266 (patch) | |
| tree | 3633add36a9bb7a6a035d94077f6245e71f93acd /src/backend/commands/functioncmds.c | |
| parent | 1812ee5767a25a36e7002be8a3a032357d3fe4e2 (diff) | |
| download | postgresql-143b39c1855f8a22f474f20354ee5ee5d2f4d266.tar.gz postgresql-143b39c1855f8a22f474f20354ee5ee5d2f4d266.zip | |
Rename pg_rowsecurity -> pg_policy and other fixes
As pointed out by Robert, we should really have named pg_rowsecurity
pg_policy, as the objects stored in that catalog are policies. This
patch fixes that and updates the column names to start with 'pol' to
match the new catalog name.
The security consideration for COPY with row level security, also
pointed out by Robert, has also been addressed by remembering and
re-checking the OID of the relation initially referenced during COPY
processing, to make sure it hasn't changed under us by the time we
finish planning out the query which has been built.
Robert and Alvaro also commented on missing OCLASS and OBJECT entries
for POLICY (formerly ROWSECURITY or POLICY, depending) in various
places. This patch fixes that too, which also happens to add the
ability to COMMENT on policies.
In passing, attempt to improve the consistency of messages, comments,
and documentation as well. This removes various incarnations of
'row-security', 'row-level security', 'Row-security', etc, in favor
of 'policy', 'row level security' or 'row_security' as appropriate.
Happy Thanksgiving!
Diffstat (limited to 'src/backend/commands/functioncmds.c')
| -rw-r--r-- | src/backend/commands/functioncmds.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/backend/commands/functioncmds.c b/src/backend/commands/functioncmds.c index 470db5705cc..d3a59aa3567 100644 --- a/src/backend/commands/functioncmds.c +++ b/src/backend/commands/functioncmds.c @@ -904,9 +904,9 @@ CreateFunction(CreateFunctionStmt *stmt, const char *queryString) ReleaseSysCache(languageTuple); /* - * Only superuser is allowed to create leakproof functions because it - * possibly allows unprivileged users to reference invisible tuples to be - * filtered out using views for row-level security. + * Only superuser is allowed to create leakproof functions because leakproof + * functions can see tuples which have not yet been filtered out by security + * barrier views or row level security policies. */ if (isLeakProof && !superuser()) ereport(ERROR, |