diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2016-06-18 19:38:59 -0400 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2016-06-18 19:38:59 -0400 |
| commit | 9bc3332372f9992875d80f856fd98999e070fe35 (patch) | |
| tree | 370ff5ea51c984b986062089b9cb357212fb4a88 /src | |
| parent | a3f42e85464c4e6ed87a74d8903923e2bd734e0c (diff) | |
| download | postgresql-9bc3332372f9992875d80f856fd98999e070fe35.tar.gz postgresql-9bc3332372f9992875d80f856fd98999e070fe35.zip | |
Improve error message annotation for GRANT/REVOKE on untrusted PLs.
The annotation for "ERROR: language "foo" is not trusted" used to say
"HINT: Only superusers can use untrusted languages", which was fairly
poorly thought out. For one thing, it's not a hint about what to do,
but a statement of fact, which makes it errdetail. But also, this
fails to clarify things much, because there's a missing step in the
chain of reasoning. I think it's more useful to say "GRANT and REVOKE
are not allowed on untrusted languages, because only superusers can use
untrusted languages".
It's been like this for a long time, but given the lack of previous
complaints, I don't think this is worth back-patching.
Discussion: <1417.1466289901@sss.pgh.pa.us>
Diffstat (limited to 'src')
| -rw-r--r-- | src/backend/catalog/aclchk.c | 3 | ||||
| -rw-r--r-- | src/test/regress/expected/privileges.out | 2 |
2 files changed, 3 insertions, 2 deletions
diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c index 1dc0f2d5ac6..a585c3ad19a 100644 --- a/src/backend/catalog/aclchk.c +++ b/src/backend/catalog/aclchk.c @@ -2592,7 +2592,8 @@ ExecGrant_Language(InternalGrant *istmt) (errcode(ERRCODE_WRONG_OBJECT_TYPE), errmsg("language \"%s\" is not trusted", NameStr(pg_language_tuple->lanname)), - errhint("Only superusers can use untrusted languages."))); + errdetail("GRANT and REVOKE are not allowed on untrusted languages, " + "because only superusers can use untrusted languages."))); /* * Get owner ID and working copy of existing ACL. If there's no ACL, diff --git a/src/test/regress/expected/privileges.out b/src/test/regress/expected/privileges.out index 88bdc2cdfcb..2c5dce47460 100644 --- a/src/test/regress/expected/privileges.out +++ b/src/test/regress/expected/privileges.out @@ -536,7 +536,7 @@ REVOKE ALL PRIVILEGES ON LANGUAGE sql FROM PUBLIC; GRANT USAGE ON LANGUAGE sql TO regressuser1; -- ok GRANT USAGE ON LANGUAGE c TO PUBLIC; -- fail ERROR: language "c" is not trusted -HINT: Only superusers can use untrusted languages. +DETAIL: GRANT and REVOKE are not allowed on untrusted languages, because only superusers can use untrusted languages. SET SESSION AUTHORIZATION regressuser1; GRANT USAGE ON LANGUAGE sql TO regressuser2; -- fail WARNING: no privileges were granted for "sql" |