QGIS Seem To Bypass PostgreSQL/PostGIS User Privileges/Permissions

From: Osahon Oduware <oduwareosahon(at)gmail(dot)com>
To: pgsql-hackers(at)postgresql(dot)org
Subject: QGIS Seem To Bypass PostgreSQL/PostGIS User Privileges/Permissions
Date: 2017-03-17 14:54:45
Message-ID: CAFmwTohpCmVr6ybeZFmkGLsYjxu1Eof-StzaUj8niTkinwQ-gA@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi All,

I created a "Read-only" User in PostgreSQL via a Role with "SELECT" ONLY
privilege on all tables in a schema as shown below:

GRANT SELECT ON ALL TABLES IN SCHEMA [schema_name] TO [role_name]
GRANT [role_name] TO [user_name]

Next, I test this by trying to UPDATE a column in a table (same schema as
above) with pgAdmin/psql and this works fine by giving a response that the
user has no permission - 'ERROR: permission denied for relation
<table_name>.'

Next, I connect with the same user in QGIS and add a layer from the same
table (same schema as above). I open the attribute table for the layer,
turn on editing mode (by clicking on the pencil-like icon), and edit the
same field/column above. To my surprise, the edit was saved successfully
without any permission error prompt.

Next, I check the value of the field/column (same table/schema as above) in
pgAdmin/psql and it is having the new (edited) value from QGIS. This is
rather strange as it seems QGIS is bypassing the permissions set for the
same user in the PostgreSQL/PostGIS database.

I will be glad if someone can help me unravel this mystery.

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Peter Eisentraut 2017-03-17 14:59:33 Re: PATCH: pageinspect / add page_checksum and bt_page_items(bytea)
Previous Message Andrew Dunstan 2017-03-17 14:51:43 Re: [COMMITTERS] pgsql: Use asynchronous connect API in libpqwalreceiver