From 04d22977acd8ada50a767b5717ee5d29cba09c3f Mon Sep 17 00:00:00 2001 From: Jeff Davis Date: Thu, 30 Jul 2026 20:28:47 -0700 Subject: [PATCH v3 10/11] Revert "Validate subscription conninfo on owner change" This reverts commit 1c9c35890421e96a91129b51f2c6446a6d95af95. Discussion: https://postgr.es/m/e103ae8daf74485e0c0ebde297fae735d38f54d1.camel@j-davis.com Backpatch-through: 19 --- doc/src/sgml/ref/alter_subscription.sgml | 7 ------- src/backend/commands/subscriptioncmds.c | 14 ++------------ src/test/regress/expected/subscription.out | 21 --------------------- src/test/regress/regress.c | 9 --------- src/test/regress/sql/subscription.sql | 18 ------------------ 5 files changed, 2 insertions(+), 67 deletions(-) diff --git a/doc/src/sgml/ref/alter_subscription.sgml b/doc/src/sgml/ref/alter_subscription.sgml index 0f81af5608b..6fc3e07a2d5 100644 --- a/doc/src/sgml/ref/alter_subscription.sgml +++ b/doc/src/sgml/ref/alter_subscription.sgml @@ -53,13 +53,6 @@ ALTER SUBSCRIPTION name RENAME TO < to alter the owner, you must be able to SET ROLE to the new owning role. If the subscription has password_required=false, only superusers can modify it. - If the subscription uses a foreign server, the new owner must have - USAGE privilege on the foreign server, a user mapping - for the new owner or for PUBLIC must exist, and the - connection string generated for the new owner must be valid. If the new - owner is not a superuser and the subscription has - password_required=true, the generated connection string - must include a password. diff --git a/src/backend/commands/subscriptioncmds.c b/src/backend/commands/subscriptioncmds.c index d52050282a5..54f35d41c27 100644 --- a/src/backend/commands/subscriptioncmds.c +++ b/src/backend/commands/subscriptioncmds.c @@ -3007,12 +3007,11 @@ AlterSubscriptionOwner_internal(Relation rel, HeapTuple tup, Oid newOwnerId) /* * If the subscription uses a server, check that the new owner has USAGE - * privileges on the server, that a user mapping exists, and that the - * resulting connection string is valid for the new owner. + * privileges on the server and that a user mapping exists. Note: does not + * re-check the resulting connection string. */ if (OidIsValid(form->subserver)) { - char *conninfo; ForeignServer *server = GetForeignServer(form->subserver); aclresult = object_aclcheck(ForeignServerRelationId, server->serverid, newOwnerId, ACL_USAGE); @@ -3025,15 +3024,6 @@ AlterSubscriptionOwner_internal(Relation rel, HeapTuple tup, Oid newOwnerId) /* make sure a user mapping exists */ GetUserMapping(newOwnerId, server->serverid); - - conninfo = ForeignServerConnectionString(newOwnerId, server); - - /* Load the library providing us libpq calls. */ - load_file("libpqwalreceiver", false); - /* Check the connection info string. */ - walrcv_check_conninfo(conninfo, - form->subpasswordrequired && - !superuser_arg(newOwnerId)); } form->subowner = newOwnerId; diff --git a/src/test/regress/expected/subscription.out b/src/test/regress/expected/subscription.out index 715c84afaa9..d447cba1397 100644 --- a/src/test/regress/expected/subscription.out +++ b/src/test/regress/expected/subscription.out @@ -9,10 +9,6 @@ CREATE FUNCTION test_fdw_connection(oid, oid, internal) RETURNS text AS :'regresslib', 'test_fdw_connection' LANGUAGE C; -CREATE FUNCTION test_fdw_connection_no_password(oid, oid, internal) - RETURNS text - AS :'regresslib', 'test_fdw_connection_no_password' - LANGUAGE C; CREATE ROLE regress_subscription_user LOGIN SUPERUSER; CREATE ROLE regress_subscription_user2; CREATE ROLE regress_subscription_user3 IN ROLE pg_create_subscription; @@ -191,22 +187,6 @@ CREATE SUBSCRIPTION regress_testsub6 SERVER test_server WARNING: subscription was created, but is not connected HINT: To initiate replication, you must manually create the replication slot, enable the subscription, and alter the subscription to refresh publications. RESET SESSION AUTHORIZATION; -GRANT USAGE ON FOREIGN SERVER test_server TO regress_subscription_user2; -CREATE USER MAPPING FOR regress_subscription_user2 SERVER test_server OPTIONS(user 'foo'); -ALTER FOREIGN DATA WRAPPER test_fdw CONNECTION test_fdw_connection_no_password; -WARNING: changing the foreign-data wrapper connection function can cause the options for dependent objects to become invalid --- fail, new owner's generated conninfo must satisfy password_required -ALTER SUBSCRIPTION regress_testsub6 OWNER TO regress_subscription_user2; -ERROR: password is required -DETAIL: Non-superusers must provide a password in the connection string. -ALTER FOREIGN DATA WRAPPER test_fdw CONNECTION test_fdw_connection; -WARNING: changing the foreign-data wrapper connection function can cause the options for dependent objects to become invalid -DROP USER MAPPING FOR regress_subscription_user2 SERVER test_server; -REVOKE USAGE ON FOREIGN SERVER test_server FROM regress_subscription_user2; --- fail, subscription depends on the server and cannot be dropped by CASCADE -DROP SERVER test_server CASCADE; -ERROR: cannot drop server test_server because subscription regress_testsub6 depends on it -HINT: Drop subscription regress_testsub6 first. REVOKE USAGE ON FOREIGN SERVER test_server FROM regress_subscription_user3; SET SESSION AUTHORIZATION regress_subscription_user3; -- ok, lacks USAGE on test_server, but replacing connection anyway @@ -258,7 +238,6 @@ HINT: Use DROP ... CASCADE to drop the dependent objects too. ALTER FOREIGN DATA WRAPPER test_fdw NO CONNECTION; WARNING: removing the foreign-data wrapper connection function will cause dependent subscriptions to fail DROP FUNCTION test_fdw_connection(oid, oid, internal); -DROP FUNCTION test_fdw_connection_no_password(oid, oid, internal); DROP FOREIGN DATA WRAPPER test_fdw; -- fail - invalid connection string during ALTER ALTER SUBSCRIPTION regress_testsub CONNECTION 'foobar'; diff --git a/src/test/regress/regress.c b/src/test/regress/regress.c index 14d301b3499..9801cdd1d8c 100644 --- a/src/test/regress/regress.c +++ b/src/test/regress/regress.c @@ -742,15 +742,6 @@ test_fdw_connection(PG_FUNCTION_ARGS) PG_RETURN_TEXT_P(cstring_to_text("dbname=regress_doesnotexist user=doesnotexist password=secret")); } -PG_FUNCTION_INFO_V1(test_fdw_connection_no_password); -Datum -test_fdw_connection_no_password(PG_FUNCTION_ARGS) -{ - /* Ensure the test fails if no valid user mapping exists. */ - GetUserMapping(PG_GETARG_OID(0), PG_GETARG_OID(1)); - PG_RETURN_TEXT_P(cstring_to_text("dbname=regress_doesnotexist user=doesnotexist")); -} - PG_FUNCTION_INFO_V1(is_catalog_text_unique_index_oid); Datum is_catalog_text_unique_index_oid(PG_FUNCTION_ARGS) diff --git a/src/test/regress/sql/subscription.sql b/src/test/regress/sql/subscription.sql index 5ee13df6653..dd33b18da55 100644 --- a/src/test/regress/sql/subscription.sql +++ b/src/test/regress/sql/subscription.sql @@ -12,10 +12,6 @@ CREATE FUNCTION test_fdw_connection(oid, oid, internal) RETURNS text AS :'regresslib', 'test_fdw_connection' LANGUAGE C; -CREATE FUNCTION test_fdw_connection_no_password(oid, oid, internal) - RETURNS text - AS :'regresslib', 'test_fdw_connection_no_password' - LANGUAGE C; CREATE ROLE regress_subscription_user LOGIN SUPERUSER; CREATE ROLE regress_subscription_user2; @@ -137,19 +133,6 @@ CREATE SUBSCRIPTION regress_testsub6 SERVER test_server PUBLICATION testpub WITH (slot_name = 'dummy', connect = false); RESET SESSION AUTHORIZATION; -GRANT USAGE ON FOREIGN SERVER test_server TO regress_subscription_user2; -CREATE USER MAPPING FOR regress_subscription_user2 SERVER test_server OPTIONS(user 'foo'); -ALTER FOREIGN DATA WRAPPER test_fdw CONNECTION test_fdw_connection_no_password; - --- fail, new owner's generated conninfo must satisfy password_required -ALTER SUBSCRIPTION regress_testsub6 OWNER TO regress_subscription_user2; - -ALTER FOREIGN DATA WRAPPER test_fdw CONNECTION test_fdw_connection; -DROP USER MAPPING FOR regress_subscription_user2 SERVER test_server; -REVOKE USAGE ON FOREIGN SERVER test_server FROM regress_subscription_user2; --- fail, subscription depends on the server and cannot be dropped by CASCADE -DROP SERVER test_server CASCADE; - REVOKE USAGE ON FOREIGN SERVER test_server FROM regress_subscription_user3; SET SESSION AUTHORIZATION regress_subscription_user3; @@ -206,7 +189,6 @@ DROP FUNCTION test_fdw_connection(oid, oid, internal); ALTER FOREIGN DATA WRAPPER test_fdw NO CONNECTION; DROP FUNCTION test_fdw_connection(oid, oid, internal); -DROP FUNCTION test_fdw_connection_no_password(oid, oid, internal); DROP FOREIGN DATA WRAPPER test_fdw; -- 2.43.0