Re: Using views for row-level access control is leaky - Mailing list pgsql-hackers

From Richard Huxton
Subject Re: Using views for row-level access control is leaky
Date
Msg-id 4AE03DE4.9050803@archonet.com
Whole thread Raw
In response to Re: Using views for row-level access control is leaky  (Pavel Stehule <pavel.stehule@gmail.com>)
List pgsql-hackers
Pavel Stehule wrote:
> What version do you have?
> 
> I am cannot repeat it.

It will depend on the relative cost of the clauses (though 0.0001 should
have been enough to force it). Try:

CREATE OR REPLACE FUNCTION row_hidden (phone text) RETURNS bool AS $$
BEGIN   RETURN phone LIKE '6%';
END;
$$ LANGUAGE plpgsql COST 999;

CREATE VIEW phone_number AS   SELECT person, phone FROM phone_data WHERE NOT row_hidden(phone);


--  Richard Huxton Archonet Ltd


pgsql-hackers by date:

Previous
From: Heikki Linnakangas
Date:
Subject: Re: Using views for row-level access control is leaky
Next
From: Pavel Stehule
Date:
Subject: Re: Using views for row-level access control is leaky