external
/
citus
mirror of https://github.com/citusdata/citus.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Perform permission checks on operations re-implemented by citus. 

Currently that's just COPY FROM.  There's other places where we could
check for permissions earlier (to fail less verbosely), but since
there's other pending changes in the whole DDL area, which is affected
by this, I'm just adding a note to those places.
pull/471/head
Andres Freund 2016-04-12 18:06:59 -07:00
parent 758a70a8ff
commit 0ce1e3ddaf
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/backend/distributed/executor/multi_utility.c
View File

@ -315,6 +315,7 @@ ProcessCopyStmt(CopyStmt *copyStatement, char *completionTag, bool *commandMustR
bool isDistributedRelation = false;
bool isFrom = copyStatement->is_from;
/* consider using RangeVarGetRelidExtended to check perms before locking */
copiedRelation = heap_openrv(copyStatement->relation,
isFrom ? RowExclusiveLock : AccessShareLock);
@ -330,6 +331,8 @@ ProcessCopyStmt(CopyStmt *copyStatement, char *completionTag, bool *commandMustR
{
if (copyStatement->is_from)
{
/* check permissions, we're bypassing postgres' normal checks */
CheckCopyPermissions(copyStatement);
CitusCopyFrom(copyStatement, completionTag);
return NULL;
}
@ -445,6 +448,12 @@ ProcessIndexStmt(IndexStmt *createIndexStatement, const char *createIndexCommand
lockmode = ShareUpdateExclusiveLock;
}
/*
* XXX: Consider using RangeVarGetRelidExtended with a permission
* checking callback. Right now we'll acquire the lock before having
* checked permissions, and will only fail when executing the actual
* index statements.
*/
relation = heap_openrv(createIndexStatement->relation, lockmode);
relationId = RelationGetRelid(relation);