From: | Samuel Gilbert <samuel(dot)gilbert(at)ec(dot)gc(dot)ca> |
---|---|
To: | pgsql-general(at)postgresql(dot)org |
Subject: | Blocked inserts on tables with FK to tables for which UPDATE has been revoked |
Date: | 2010-07-23 18:39:17 |
Message-ID: | 201007231439.17894.samuel.gilbert@ec.gc.ca |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-general |
Hello,
I have encountered a problem with inserts failing because of permissions
issues when the table in which I try to insert has foreign key constraints to
tables for which UPDATE has been revoked.
The script bellow show how to reproduce the problem with a bare-bones test
case. Reproducibility is 100% on PostgreSQL 8.2.5 (I know it's not even the
latest revision of the 8.2 line, but it's what I have to work with :( ) I
Googled the error message and a couple of meaningful keywords, searched the
documentation and the mailing list archives without success.
----------------------------------------
CREATE DATABASE test WITH OWNER afsugil ENCODING 'LATIN1';
CREATE ROLE test WITH NOCREATEDB NOCREATEROLE NOCREATEUSER INHERIT
LOGIN;
\c test afsugil
CREATE TABLE station (
id SERIAL PRIMARY KEY,
name TEXT NOT NULL UNIQUE
);
INSERT INTO station (name) VALUES ('Montreal');
INSERT INTO station (name) VALUES ('Toronto');
INSERT INTO station (name) VALUES ('Calgary');
INSERT INTO station (name) VALUES ('Vancouver');
INSERT INTO station (name) VALUES ('Halifax');
SELECT * FROM station;
-- id | name
-- ----+-----------
-- 1 | Montreal
-- 2 | Toronto
-- 3 | Calgary
-- 4 | Vancouver
-- 5 | Halifax
CREATE TABLE observation (
station INTEGER NOT NULL REFERENCES station (id) MATCH FULL,
date TIMESTAMP NOT NULL,
value REAL,
PRIMARY KEY (station, date)
);
-- The insert below works
INSERT INTO observation (station, date, value) VALUES (
1, '2010-07-22 14:00:00', 42
);
REVOKE UPDATE ON station FROM afsugil;
-- The insert below no longer works
INSERT INTO observation (station, date, value) VALUES (
2, '2010-07-22 14:00:00', 14
);
-- ERROR: permission denied for relation station
-- CONTEXT: SQL statement "SELECT 1 FROM ONLY "public"."station" x WHERE "id"
= $1 FOR SHARE OF x"
\c postgres afsudev
DROP DATABASE test;
DROP USER test;
----------------------------------------
This is a pretty severe issue for me since, I don't want users that need to
input data to also have the right to modify references tables. This is,
also, not how I would have expected the permissions to behave.
Any help to resolve this issue will be greatly appreciated!
Best Regards,
Samuel
From | Date | Subject | |
---|---|---|---|
Next Message | Andrus Moor | 2010-07-23 18:51:10 | Re: How to distribute quantity if same product is in multiple rows |
Previous Message | Scott Frankel | 2010-07-23 18:27:01 | prepared statements |