Postgres Pro
Downloads
Home   >   mailing lists

Thread: Grant RULE removed in pg 8.2

Grant RULE removed in pg 8.2

From
Erwin Brandstetter
Date:
Hi developers! Hi Dave!

Testing pgAdmin III v1.6.2 rev: 5837, client Win XP, hosts: Debian 
Sarge, PG 8.1.8 and  Debian Etch, PG 8.2.3.
Testing pgAdmin III v1.6.3 rev: 5941, client Win XP, hosts: Debian 
Sarge, PG 8.1.8 and  Debian Etch, PG 8.2.3.

I have come across a peculiarity concerning the RULE privilege.

In pg 7.4 or 8.1, the right to create rules on a table is a separate 
privilege. This was removed in pg 8.2. I quote the release notes:
http://www.postgresql.org/docs/8.2/static/release-8-2.html
   * Remove RULE permission for tables, for security reasons (Tom)     As of this release, only a table's owner can
createor modify     rules for the table. For backwards compatibility, GRANT/REVOKE     RULE is still accepted, but it
doesnothing.
 

This has side effects on pgAdmin. Properties dialogue for tables / views 
in a pg 8.2 database still shows the RULE privilege which, naturally, is 
never checked.
Granting the rule privilege seems to succeed, though it does (and can) not.
After issuing   GRANT ALL ON TABLE mytable TO postgres;
the RULE privilege is still not checked in the properties dialogue and 
the SQL definiton reads:   GRANT SELECT, UPDATE, INSERT, DELETE, REFERENCES, TRIGGER ON TABLE 
mytaqble TO postgres;

If I do the same in a pg 8.1 database I get the preferrable form of   GRANT ALL ON TABLE mytable TO postgres;
pg_dump creates the same line of code.

I seem to remember mention of version-specific settings, but I don't 
really know about that. Is it possible for you to remove the RULE 
privilege in pgAdmin for DB-clusters >= v8.2?


Regards
Erwin

Re: Grant RULE removed in pg 8.2

From
Dave Page
Date:
Hi Erwin,

Erwin Brandstetter wrote:
> Hi developers! Hi Dave!
> 
> 
> I seem to remember mention of version-specific settings, but I don't
> really know about that. Is it possible for you to remove the RULE
> privilege in pgAdmin for DB-clusters >= v8.2?

If you look when you first open a dialog you'll see it was disabled,
however when you select an existing ACL entry from the list box it was
getting re-enabled again. I've fixed this in SVN for 1.6.3.

Thanks for the report.

Regards, Dave.

Re: Grant RULE removed in pg 8.2

From
Erwin Brandstetter
Date:
Hi Dave!

Testing pgAdmin v.1.8.2 (Feb 5 2008), rev: 7050, on WinXP; host: pg 8.2.6 on 
Debian Etch

I am afraid, the RULE privilege for pg >= 8.2 has risen from the dead in 
pgadmin 1.8.2.
My original bug report (to pgadmin-support@postgresql.org at 2007-03-05) 
applies in full again.


Regards
Erwin



dpage@postgresql.org wrote:
> Hi Erwin,
(...)
> If you look when you first open a dialog you'll see it was disabled,
> however when you select an existing ACL entry from the list box it was
> getting re-enabled again. I've fixed this in SVN for 1.6.3.
> 
> Thanks for the report.
> 
> Regards, Dave.

Re: Grant RULE removed in pg 8.2

From
Erwin Brandstetter
Date:
I slightly miswrote:
> I am afraid, the RULE privilege for pg >= 8.2 has risen from the dead 
> in pgadmin 1.8.2.
> My original bug report (to pgadmin-support@postgresql.org at 
> 2007-03-05) applies in full again.

Mistaken I am! A related, but different bug it is. This time, views it 
affects, not tables.

Regards
Obi wan .. uhm .. Erwin

Debuging pgplsql procedures

From
Julius Tuskenis
Date:
Hello

Is there any way debugging Postgresql functions? Is it possible to set 
brake points or something similar into it?

Julius

Re: Grant RULE removed in pg 8.2

From
"Dave Page"
Date:
On Tue, Apr 1, 2008 at 1:17 AM, Erwin Brandstetter
<a9006241@unet.univie.ac.at> wrote:
> I slightly miswrote:
>
>
> > I am afraid, the RULE privilege for pg >= 8.2 has risen from the dead in
> pgadmin 1.8.2.
> > My original bug report (to pgadmin-support@postgresql.org at 2007-03-05)
> applies in full again.
> >
>
>  Mistaken I am! A related, but different bug it is. This time, views it
> affects, not tables.

Fixed it is. Pleased you'll be.

-- 
Dave Page
EnterpriseDB UK: http://www.enterprisedb.com

Re: Grant RULE removed in pg 8.2

From
Erwin Brandstetter
Date:
Dave Page wrote:
> On Tue, Apr 1, 2008 at 1:17 AM, Erwin Brandstetter
> <a9006241@unet.univie.ac.at> wrote:
>   
>> Mistaken I am! A related, but different bug it is. This time, views it
>> affects, not tables.
>>     
>
> Fixed it is. Pleased you'll be.
>   

Pleased I shall be. May the force be with you, Master Dave!

Re: Grant RULE removed in pg 8.2

From
Erwin Brandstetter
Date:
dpage@pgadmin.org wrote:
> Fixed it is. Pleased you'll be.

Patience you shall need, master Dave!
Testing pgAdmin v.1.9.0-Dev (May 2 2008), rev: 7245:7266M, on WinXP; 
host: pg 8.2.7 and 8.3.1 on Debian Etch.

The "Privileges" dialog seems fixed. But the reverse engineered SQL doesn't:
If I say:   GRANT ALL ON TABLE test TO dummy;
then SQL pane says:   GRANT ALL ON TABLE test TO dummy;

But if I say:   GRANT ALL ON TABLE v_test TO dummy;      -- v_test being a VIEW
then SQL pane says:   GRANT SELECT, UPDATE, INSERT, DELETE, REFERENCES, TRIGGER ON TABLE 
v_test TO dummy;

The latter should read the same as the former.


Regards
Erwin

Re: Grant RULE removed in pg 8.2

From
"Dave Page"
Date:
On Sat, May 3, 2008 at 12:13 AM, Erwin Brandstetter
<brandstetter@falter.at> wrote:
> dpage@pgadmin.org wrote:
> > Fixed it is. Pleased you'll be.
> >
>
> Patience you shall need, master Dave!
> Testing pgAdmin v.1.9.0-Dev (May 2 2008), rev: 7245:7266M, on WinXP; host:
> pg 8.2.7 and 8.3.1 on Debian Etch.
>
> The "Privileges" dialog seems fixed. But the reverse engineered SQL doesn't:

Fixed.

-- 
Dave Page
EnterpriseDB UK: http://www.enterprisedb.com