BUG #4350: 'select' acess given to views containing "union all" even though user has no grants - Mailing list pgsql-bugs

The following bug has been logged online:

Bug reference:      4350
Logged by:          Brendan O'Shea
Email address:      boshea@akamai.com
PostgreSQL version: 8.2.9
Operating system:   linux-2.4 and windows XP
Description:        'select' acess given to views containing "union all"
even though user has no grants
Details:

There appears to be a bug in the way that permissions are determined for
views that contain "UNION ALL" in their definition.

There is a simple test case to reproduce the bug.

1) As a superuser create the following objects:

CREATE ROLE test_perm LOGIN PASSWORD 'test_perm';

CREATE OR REPLACE VIEW public.simple_select AS SELECT 1;
CREATE OR REPLACE VIEW public.union_all AS SELECT 1 UNION ALL SELECT 2;


2) Now log in as the test_perm user and run the following SQL:

select * from public.simple_select;
select * from public.union_all;

The first SQL statement correctly produces an error, but the second
statement will return results with no error, it should instead generate a
permission error.