diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2017-03-31 18:11:25 -0400 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2017-03-31 18:11:30 -0400 |
| commit | 64d4da511c012faff8ac309595620938a43c6817 (patch) | |
| tree | 9e33373fbe92f59174e28d92232564cac2f14ed5 /src/backend/commands/tablecmds.c | |
| parent | 8f18a880a5f138d4da94173d15514142331f8de6 (diff) | |
| download | postgresql-64d4da511c012faff8ac309595620938a43c6817.tar.gz postgresql-64d4da511c012faff8ac309595620938a43c6817.zip | |
For foreign keys, check REFERENCES privilege only on the referenced table.
We were requiring that the user have REFERENCES permission on both the
referenced and referencing tables --- but this doesn't seem to have any
support in the SQL standard, which says only that you need REFERENCES
permission on the referenced table. And ALTER TABLE ADD FOREIGN KEY has
already checked that you own the referencing table, so the check could
only fail if a table owner has revoked his own REFERENCES permission.
Moreover, the symmetric interpretation of this permission is unintuitive
and confusing, as per complaint from Paul Jungwirth. So let's drop the
referencing-side check.
In passing, do a bit of wordsmithing on the GRANT reference page so that
all the privilege types are described in similar fashion.
Discussion: https://postgr.es/m/8940.1490906755@sss.pgh.pa.us
Diffstat (limited to 'src/backend/commands/tablecmds.c')
| -rw-r--r-- | src/backend/commands/tablecmds.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/backend/commands/tablecmds.c b/src/backend/commands/tablecmds.c index 4cf2efb2ad9..d418d56b549 100644 --- a/src/backend/commands/tablecmds.c +++ b/src/backend/commands/tablecmds.c @@ -6817,7 +6817,6 @@ ATAddForeignKeyConstraint(AlteredTableInfo *tab, Relation rel, * Now we can check permissions. */ checkFkeyPermissions(pkrel, pkattnum, numpks); - checkFkeyPermissions(rel, fkattnum, numfks); /* * Look up the equality operators to use in the constraint. @@ -7745,7 +7744,12 @@ findFkeyCast(Oid targetTypeId, Oid sourceTypeId, Oid *funcid) return ret; } -/* Permissions checks for ADD FOREIGN KEY */ +/* + * Permissions checks on the referenced table for ADD FOREIGN KEY + * + * Note: we have already checked that the user owns the referencing table, + * else we'd have failed much earlier; no additional checks are needed for it. + */ static void checkFkeyPermissions(Relation rel, int16 *attnums, int natts) { |