| From: | Robert Haas <robertmhaas(at)gmail(dot)com> |
|---|---|
| To: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
| Cc: | KaiGai Kohei <kaigai(at)kaigai(dot)gr(dot)jp>, KaiGai Kohei <kaigai(at)ak(dot)jp(dot)nec(dot)com>, Itagaki Takahiro <itagaki(dot)takahiro(at)gmail(dot)com>, Heikki Linnakangas <heikki(dot)linnakangas(at)enterprisedb(dot)com>, pgsql-hackers(at)postgresql(dot)org |
| Subject: | Re: leaky views, yet again |
| Date: | 2010-10-05 17:03:45 |
| Message-ID: | AANLkTinLXKvfBCXzfZCC-FzTJpR=nJ32yeWnzy7Z2yaT@mail.gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Tue, Oct 5, 2010 at 12:27 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
>> Option #1: Remove all mention from the documentation of using views
>> for security purposes. Don't allow views to have explicit permissions
>> attached to them; they are merely shorthand for a SELECT, for which
>> you either do or do not have privileges.
>
> The SQL standard requires us to attach permissions to views. The
> standard makes no claims whatsoever about how leak-proof views should
> be; it only says that you can't call a view without the appropriate
> permissions.
>
> I do think it's reasonable for the docs to point out that views that do
> row-filtering should not be presumed to be absolutely bulletproof.
> That doesn't make permissions on them useless, so you're attacking a
> straw man.
Really? I'm confused. What is the use case for the status quo?
--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise Postgres Company
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tom Lane | 2010-10-05 17:29:06 | Re: leaky views, yet again |
| Previous Message | Tom Lane | 2010-10-05 16:49:15 | Re: patch: SQL/MED(FDW) DDL |