Re: WITH CHECK and Column-Level Privileges

* Stephen Frost (sfrost(at)snowman(dot)net) wrote:
> > Looks like there is an issue here with CHECK constraints and NOT NULL
> > constraints, yes. The uniqueness check complains about the key already
> > existing and returns the key, but I don't think that's actually a
> > problem- to get that to happen you have to specify the new key and
> > that's what is returned.
>
> Yeah, I take that back. If there is a composite key involved then you
> can run into the same issue- you update one of the columns to a
> conflicting value and get back the entire key, including columns you
> shouldn't be allowed to see.

Alright, attached is a patch which addresses this by checking if the
user has SELECT rights on the relation first and, if so, the existing
error message is returned with the full row as usual, but if not, then
the row data is omitted.

Also attached is a patch for 9.4 which does the same, but also removes
the row reporting (completely) from the WITH CHECK case. It could be
argued that it would be helpful to have it there also, perhaps, but I'm
not convinced at this point that it's really valuable- and we'd have to
think about how this would work with views (permission on the view? or
on the table underneath? what if there is more than one?, etc).

Thanks,

Stephen