DROP TABLE can be issued by schema owner as well as table owner

From: Derrick Rice <derrick(dot)rice(at)gmail(dot)com>
To: pgsql-docs(at)postgresql(dot)org
Subject: DROP TABLE can be issued by schema owner as well as table owner
Date: 2011-05-20 15:42:32
Message-ID: BANLkTikpQfBj8EMwjwrA1kXOF1F8J4H6Hw@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-docs

According to

http://www.postgresql.org/docs/9.0/interactive/sql-droptable.html

"DROP TABLE removes tables from the database. Only its owner can drop a
table."

In fact, the schema owner can drop the table, which is clearly stated here:

http://www.postgresql.org/docs/9.0/interactive/sql-dropschema.html

"A schema can only be dropped by its owner or a superuser. Note that the
owner can drop the schema (and thereby all contained objects) even if he
does not own some of the objects within the schema."

There are likely other places besides the DROP TABLE page which can be
misleading with regard to ability to drop a table. This should be made more
clear, since in (possibly contrived) circumstances, being able to drop a
table and recreate an exactly similar table may be a vulnerability (if the
design assumed the table could only be dropped by the owner).

(Just joined the list to post this -- sorry if it has already been brought
up)

Derrick

Responses

Browse pgsql-docs by date

  From Date Subject
Next Message Guillaume Lelarge 2011-05-20 16:18:13 Re: DROP TABLE can be issued by schema owner as well as table owner
Previous Message Susanne Ebrecht 2011-05-20 13:04:26 Re: non-ASCII characters in SGML documentation (and elsewhere)