This is the final state of the rule system for 6.4 after the
patch is applied:
Rewrite rules on relation level work fine now.
Event qualifications on insert/update/delete rules work
fine now.
I added the new keyword OLD to reference the CURRENT
tuple. CURRENT will be removed in 6.5.
Update rules can reference NEW and OLD in the rule
qualification and the actions.
Insert/update/delete rules on views can be established to
let them behave like real tables.
For insert/update/delete rules multiple actions are
supported now. The actions can also be surrounded by
parantheses to make psql happy. Multiple actions are
required if update to a view requires updates to multiple
tables.
Regular users are permitted to create/drop rules on
tables they have RULE permissions for
(DefineQueryRewrite() is now able to get around the
access restrictions on pg_rewrite). This enables view
creation for regular users too. This required an extra
boolean parameter to pg_parse_and_plan() that tells to
set skipAcl on all rangetable entries of the resulting
queries. There is a new function
pg_exec_query_acl_override() that could be used by
backend utilities to use this facility.
All rule actions (not only views) inherit the permissions
of the event relations owner. Sample: User A creates
tables T1 and T2, creates rules that log
INSERT/UPDATE/DELETE on T1 in T2 (like in the regression
tests for rules I created) and grants ALL but RULE on T1
to user B. User B can now fully access T1 and the
logging happens in T2. But user B cannot access T2 at
all, only the rule actions can. And due to missing RULE
permissions on T1, user B cannot disable logging.
Rules on the attribute level are disabled (they don't
work properly and since regular users are now permitted
to create rules I decided to disable them).
Rules on select must have exactly one action that is a
select (so select rules must be a view definition).
UPDATE NEW/OLD rules are disabled (still broken, but
triggers can do it).
There are two new system views (pg_rule and pg_view) that
show the definition of the rules or views so the db admin
can see what the users do. They use two new functions
pg_get_ruledef() and pg_get_viewdef() that are builtins.
The functions pg_get_ruledef() and pg_get_viewdef() could
be used to implement rule and view support in pg_dump.
PostgreSQL is now the only database system I know, that
has rewrite rules on the query level. All others (where I
found a rule statement at all) use stored database
procedures or the like (triggers as we call them) for
active rules (as some call them).
Future of the rule system:
The now disabled parts of the rule system (attribute
level, multiple actions on select and update new stuff)
require a complete new rewrite handler from scratch. The
old one is too badly wired up.
After 6.4 I'll start to work on a new rewrite handler,
that fully supports the attribute level rules, multiple
actions on select and update new. This will be available
for 6.5 so we get full rewrite rule capabilities.
Jan
This commit is contained in:
Bruce Momjian
parent
f92994b1bd
commit
15cb32d93e
|
|
@ -7,7 +7,7 @@
|
|||
*
|
||||
*
|
||||
* IDENTIFICATION
|
||||
* $Header: /cvsroot/pgsql/src/backend/catalog/heap.c,v 1.59 1998/08/20 22:07:32 momjian Exp $
|
||||
* $Header: /cvsroot/pgsql/src/backend/catalog/heap.c,v 1.60 1998/08/24 01:37:46 momjian Exp $
|
||||
*
|
||||
* INTERFACE ROUTINES
|
||||
* heap_create() - Create an uncataloged heap relation
|
||||
|
|
@ -1448,7 +1448,7 @@ start:;
|
|||
sprintf(str, "select %s%s from %.*s", attrdef->adsrc, cast,
|
||||
NAMEDATALEN, rel->rd_rel->relname.data);
|
||||
setheapoverride(true);
|
||||
planTree_list = (List *) pg_parse_and_plan(str, NULL, 0, &queryTree_list, None);
|
||||
planTree_list = (List *) pg_parse_and_plan(str, NULL, 0, &queryTree_list, None, FALSE);
|
||||
setheapoverride(false);
|
||||
query = (Query *) (queryTree_list->qtrees[0]);
|
||||
|
||||
|
|
@ -1519,7 +1519,7 @@ StoreRelCheck(Relation rel, ConstrCheck *check)
|
|||
sprintf(str, "select 1 from %.*s where %s",
|
||||
NAMEDATALEN, rel->rd_rel->relname.data, check->ccsrc);
|
||||
setheapoverride(true);
|
||||
planTree_list = (List *) pg_parse_and_plan(str, NULL, 0, &queryTree_list, None);
|
||||
planTree_list = (List *) pg_parse_and_plan(str, NULL, 0, &queryTree_list, None, FALSE);
|
||||
setheapoverride(false);
|
||||
query = (Query *) (queryTree_list->qtrees[0]);
|
||||
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
*
|
||||
*
|
||||
* IDENTIFICATION
|
||||
* $Header: /cvsroot/pgsql/src/backend/catalog/pg_proc.c,v 1.19 1998/08/19 02:01:37 momjian Exp $
|
||||
* $Header: /cvsroot/pgsql/src/backend/catalog/pg_proc.c,v 1.20 1998/08/24 01:37:47 momjian Exp $
|
||||
*
|
||||
*-------------------------------------------------------------------------
|
||||
*/
|
||||
|
|
@ -214,7 +214,7 @@ ProcedureCreate(char *procedureName,
|
|||
if (strcmp(languageName, "sql") == 0)
|
||||
{
|
||||
plan_list = pg_parse_and_plan(prosrc, typev, parameterCount,
|
||||
&querytree_list, dest);
|
||||
&querytree_list, dest, FALSE);
|
||||
|
||||
/* typecheck return value */
|
||||
pg_checkretval(typeObjectId, querytree_list);
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
*
|
||||
*
|
||||
* IDENTIFICATION
|
||||
* $Header: /cvsroot/pgsql/src/backend/executor/functions.c,v 1.17 1998/06/15 19:28:20 momjian Exp $
|
||||
* $Header: /cvsroot/pgsql/src/backend/executor/functions.c,v 1.18 1998/08/24 01:37:48 momjian Exp $
|
||||
*
|
||||
*-------------------------------------------------------------------------
|
||||
*/
|
||||
|
|
@ -113,7 +113,7 @@ init_execution_state(FunctionCachePtr fcache,
|
|||
|
||||
|
||||
planTree_list = (List *)
|
||||
pg_parse_and_plan(fcache->src, fcache->argOidVect, nargs, &queryTree_list, None);
|
||||
pg_parse_and_plan(fcache->src, fcache->argOidVect, nargs, &queryTree_list, None, FALSE);
|
||||
|
||||
for (i = 0; i < queryTree_list->len; i++)
|
||||
{
|
||||
|
|
|
|||
|
|
@ -642,7 +642,7 @@ _SPI_execute(char *src, int tcount, _SPI_plan *plan)
|
|||
argtypes = plan->argtypes;
|
||||
}
|
||||
ptlist = planTree_list = (List *)
|
||||
pg_parse_and_plan(src, argtypes, nargs, &queryTree_list, None);
|
||||
pg_parse_and_plan(src, argtypes, nargs, &queryTree_list, None, FALSE);
|
||||
|
||||
_SPI_current->qtlist = queryTree_list;
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
*
|
||||
*
|
||||
* IDENTIFICATION
|
||||
* $Header: /cvsroot/pgsql/src/backend/libpq/Attic/be-pqexec.c,v 1.17 1998/06/15 19:28:25 momjian Exp $
|
||||
* $Header: /cvsroot/pgsql/src/backend/libpq/Attic/be-pqexec.c,v 1.18 1998/08/24 01:37:52 momjian Exp $
|
||||
*
|
||||
*-------------------------------------------------------------------------
|
||||
*/
|
||||
|
|
@ -137,7 +137,7 @@ PQexec(char *query)
|
|||
* end up on the top of the portal stack.
|
||||
* ----------------
|
||||
*/
|
||||
pg_exec_query_dest(query, Local);
|
||||
pg_exec_query_dest(query, Local, FALSE);
|
||||
|
||||
/* ----------------
|
||||
* pop the portal off the portal stack and return the
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@
|
|||
*
|
||||
*
|
||||
* IDENTIFICATION
|
||||
* $Header: /cvsroot/pgsql/src/backend/optimizer/path/Attic/xfunc.c,v 1.19 1998/08/19 02:02:13 momjian Exp $
|
||||
* $Header: /cvsroot/pgsql/src/backend/optimizer/path/Attic/xfunc.c,v 1.20 1998/08/24 01:37:53 momjian Exp $
|
||||
*
|
||||
*-------------------------------------------------------------------------
|
||||
*/
|
||||
|
|
@ -528,7 +528,7 @@ xfunc_func_expense(LispValue node, LispValue args)
|
|||
if (nargs > 0)
|
||||
argOidVect = proc->proargtypes;
|
||||
planlist = (List) pg_parse_and_plan(pq_src, argOidVect, nargs,
|
||||
&parseTree_list, None);
|
||||
&parseTree_list, None, FALSE);
|
||||
if (IsA(node, Func))
|
||||
set_func_planlist((Func) node, planlist);
|
||||
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
*
|
||||
*
|
||||
* IDENTIFICATION
|
||||
* $Header: /cvsroot/pgsql/src/backend/parser/keywords.c,v 1.38 1998/07/24 03:31:24 scrappy Exp $
|
||||
* $Header: /cvsroot/pgsql/src/backend/parser/keywords.c,v 1.39 1998/08/24 01:37:55 momjian Exp $
|
||||
*
|
||||
*-------------------------------------------------------------------------
|
||||
*/
|
||||
|
|
@ -66,7 +66,12 @@ static ScanKeyword ScanKeywords[] = {
|
|||
{"createdb", CREATEDB},
|
||||
{"createuser", CREATEUSER},
|
||||
{"cross", CROSS},
|
||||
{"current", CURRENT},
|
||||
{"current", CURRENT}, /*
|
||||
* 6.4 to 6.5 is migration time!
|
||||
* CURRENT will be removed in 6.5!
|
||||
* Use OLD keyword in rules.
|
||||
* Jan
|
||||
*/
|
||||
{"current_date", CURRENT_DATE},
|
||||
{"current_time", CURRENT_TIME},
|
||||
{"current_timestamp", CURRENT_TIMESTAMP},
|
||||
|
|
@ -152,6 +157,7 @@ static ScanKeyword ScanKeywords[] = {
|
|||
{"null", NULL_P},
|
||||
{"numeric", NUMERIC},
|
||||
{"oids", OIDS},
|
||||
{"old", OLD},
|
||||
{"on", ON},
|
||||
{"operator", OPERATOR},
|
||||
{"option", OPTION},
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
*
|
||||
*
|
||||
* IDENTIFICATION
|
||||
* $Header: /cvsroot/pgsql/src/backend/rewrite/Attic/locks.c,v 1.10 1998/06/15 19:29:06 momjian Exp $
|
||||
* $Header: /cvsroot/pgsql/src/backend/rewrite/Attic/locks.c,v 1.11 1998/08/24 01:37:56 momjian Exp $
|
||||
*
|
||||
*-------------------------------------------------------------------------
|
||||
*/
|
||||
|
|
@ -18,6 +18,14 @@
|
|||
#include "utils/syscache.h" /* for SearchSysCache */
|
||||
#include "rewrite/locks.h" /* for rewrite specific lock defns */
|
||||
|
||||
#include "access/heapam.h" /* for ACL checking */
|
||||
#include "utils/syscache.h"
|
||||
#include "utils/acl.h"
|
||||
#include "utils/builtins.h"
|
||||
#include "catalog/pg_shadow.h"
|
||||
|
||||
static void checkLockPerms(List *locks, Query *parsetree, int rt_index);
|
||||
|
||||
/*
|
||||
* ThisLockWasTriggered
|
||||
*
|
||||
|
|
@ -156,5 +164,98 @@ matchLocks(CmdType event,
|
|||
}
|
||||
}
|
||||
|
||||
checkLockPerms(real_locks, parsetree, varno);
|
||||
|
||||
return (real_locks);
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
checkLockPerms(List *locks, Query *parsetree, int rt_index)
|
||||
{
|
||||
Relation ev_rel;
|
||||
HeapTuple usertup;
|
||||
char *evowner;
|
||||
RangeTblEntry *rte;
|
||||
int32 reqperm;
|
||||
int32 aclcheck_res;
|
||||
int i;
|
||||
List *l;
|
||||
|
||||
if (locks == NIL)
|
||||
return;
|
||||
|
||||
/*
|
||||
* Get the usename of the rules event relation owner
|
||||
*/
|
||||
rte = (RangeTblEntry *)nth(rt_index - 1, parsetree->rtable);
|
||||
ev_rel = heap_openr(rte->relname);
|
||||
usertup = SearchSysCacheTuple(USESYSID,
|
||||
ObjectIdGetDatum(ev_rel->rd_rel->relowner),
|
||||
0, 0, 0);
|
||||
if (!HeapTupleIsValid(usertup))
|
||||
{
|
||||
elog(ERROR, "cache lookup for userid %d failed",
|
||||
ev_rel->rd_rel->relowner);
|
||||
}
|
||||
heap_close(ev_rel);
|
||||
evowner = nameout(&(((Form_pg_shadow) GETSTRUCT(usertup))->usename));
|
||||
|
||||
/*
|
||||
* Check all the locks, that should get fired on this query
|
||||
*/
|
||||
foreach (l, locks) {
|
||||
RewriteRule *onelock = (RewriteRule *)lfirst(l);
|
||||
List *action;
|
||||
|
||||
/*
|
||||
* In each lock check every action
|
||||
*/
|
||||
foreach (action, onelock->actions) {
|
||||
Query *query = (Query *)lfirst(action);
|
||||
|
||||
/*
|
||||
* In each action check every rangetable entry
|
||||
* for read/write permission of the event relations
|
||||
* owner depending on if it's the result relation
|
||||
* (write) or not (read)
|
||||
*/
|
||||
for (i = 2; i < length(query->rtable); i++) {
|
||||
if (i + 1 == query->resultRelation)
|
||||
switch (query->resultRelation) {
|
||||
case CMD_INSERT:
|
||||
reqperm = ACL_AP;
|
||||
break;
|
||||
default:
|
||||
reqperm = ACL_WR;
|
||||
break;
|
||||
}
|
||||
else
|
||||
reqperm = ACL_RD;
|
||||
|
||||
rte = (RangeTblEntry *)nth(i, query->rtable);
|
||||
aclcheck_res = pg_aclcheck(rte->relname,
|
||||
evowner, reqperm);
|
||||
if (aclcheck_res != ACLCHECK_OK) {
|
||||
elog(ERROR, "%s: %s",
|
||||
rte->relname,
|
||||
aclcheck_error_strings[aclcheck_res]);
|
||||
}
|
||||
|
||||
/*
|
||||
* So this is allowed due to the permissions
|
||||
* of the rules event relation owner. But
|
||||
* let's see if the next one too
|
||||
*/
|
||||
rte->skipAcl = TRUE;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Phew, that was close
|
||||
*/
|
||||
return;
|
||||
}
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
*
|
||||
*
|
||||
* IDENTIFICATION
|
||||
* $Header: /cvsroot/pgsql/src/backend/rewrite/rewriteDefine.c,v 1.18 1998/08/19 02:02:29 momjian Exp $
|
||||
* $Header: /cvsroot/pgsql/src/backend/rewrite/rewriteDefine.c,v 1.19 1998/08/24 01:37:58 momjian Exp $
|
||||
*
|
||||
*-------------------------------------------------------------------------
|
||||
*/
|
||||
|
|
@ -131,7 +131,7 @@ InsertRule(char *rulname,
|
|||
rulname, evtype, eventrel_oid, evslot_index, actionbuf,
|
||||
qualbuf, is_instead);
|
||||
|
||||
pg_exec_query(rulebuf);
|
||||
pg_exec_query_acl_override(rulebuf);
|
||||
|
||||
return (LastOidProcessed);
|
||||
}
|
||||
|
|
@ -192,12 +192,61 @@ DefineQueryRewrite(RuleStmt *stmt)
|
|||
Oid event_attype = 0;
|
||||
char *actionP,
|
||||
*event_qualP;
|
||||
List *l;
|
||||
Query *query;
|
||||
|
||||
/* ----------
|
||||
* The current rewrite handler is known to work on relation level
|
||||
* rules only. And for SELECT events, it expects one non-nothing
|
||||
* action that is instead. Since we now hand out views and rules
|
||||
* to regular users, we must deny anything else.
|
||||
*
|
||||
* I know that I must write a new rewrite handler from scratch
|
||||
* for 6.5 so we can remove these checks and allow all the rules.
|
||||
*
|
||||
* Jan
|
||||
* ----------
|
||||
*/
|
||||
if (event_obj->attrs)
|
||||
elog(ERROR, "attribute level rules currently not supported");
|
||||
/*
|
||||
eslot_string = strVal(lfirst(event_obj->attrs));
|
||||
*/
|
||||
else
|
||||
eslot_string = NULL;
|
||||
|
||||
if (action != NIL)
|
||||
foreach (l, action) {
|
||||
query = (Query *)lfirst(l);
|
||||
if (query->resultRelation == 1) {
|
||||
elog(NOTICE, "rule actions on OLD currently not supported");
|
||||
elog(ERROR, " use views or triggers instead");
|
||||
}
|
||||
if (query->resultRelation == 2) {
|
||||
elog(NOTICE, "rule actions on NEW currently not supported");
|
||||
elog(ERROR, " use triggers instead");
|
||||
}
|
||||
}
|
||||
|
||||
if (event_type == CMD_SELECT) {
|
||||
if (length(action) == 0) {
|
||||
elog(NOTICE, "instead nothing rules on select currently not supported");
|
||||
elog(ERROR, " use views instead");
|
||||
}
|
||||
if (length(action) > 1) {
|
||||
elog(ERROR, "multiple action rules on select currently not supported");
|
||||
}
|
||||
query = (Query *)lfirst(action);
|
||||
if (!is_instead || query->commandType != CMD_SELECT) {
|
||||
elog(ERROR, "only instead-select rules currently supported on select");
|
||||
}
|
||||
}
|
||||
/*
|
||||
* This rule is currently allowed - too restricted I know -
|
||||
* but women and children first
|
||||
* Jan
|
||||
*/
|
||||
|
||||
event_relation = heap_openr(event_obj->relname);
|
||||
if (event_relation == NULL)
|
||||
elog(ERROR, "virtual relations not supported yet");
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
*
|
||||
*
|
||||
* IDENTIFICATION
|
||||
* $Header: /cvsroot/pgsql/src/backend/rewrite/rewriteHandler.c,v 1.19 1998/08/19 02:02:30 momjian Exp $
|
||||
* $Header: /cvsroot/pgsql/src/backend/rewrite/rewriteHandler.c,v 1.20 1998/08/24 01:37:59 momjian Exp $
|
||||
*
|
||||
*-------------------------------------------------------------------------
|
||||
*/
|
||||
|
|
@ -45,7 +45,6 @@ fireRules(Query *parsetree, int rt_index, CmdType event,
|
|||
static void QueryRewriteSubLink(Node *node);
|
||||
static List *QueryRewriteOne(Query *parsetree);
|
||||
static List *deepRewriteQuery(Query *parsetree);
|
||||
static void CheckViewPerms(Relation view, List *rtable);
|
||||
static void RewritePreprocessQuery(Query *parsetree);
|
||||
static Query *RewritePostprocessNonSelect(Query *parsetree);
|
||||
|
||||
|
|
@ -273,7 +272,6 @@ ApplyRetrieveRule(Query *parsetree,
|
|||
int nothing,
|
||||
rt_length;
|
||||
int badsql = FALSE;
|
||||
int viewAclOverride = FALSE;
|
||||
|
||||
rule_qual = rule->qual;
|
||||
if (rule->actions)
|
||||
|
|
@ -291,19 +289,6 @@ ApplyRetrieveRule(Query *parsetree,
|
|||
return;
|
||||
rule_action = copyObject(lfirst(rule->actions));
|
||||
nothing = FALSE;
|
||||
|
||||
/*
|
||||
* If this rule is on the relation level, the rule action is a
|
||||
* select and the rule is instead then it must be a view.
|
||||
* Permissions for views now follow the owner of the view, not the
|
||||
* current user.
|
||||
*/
|
||||
if (relation_level && rule_action->commandType == CMD_SELECT
|
||||
&& rule->isInstead)
|
||||
{
|
||||
CheckViewPerms(relation, rule_action->rtable);
|
||||
viewAclOverride = TRUE;
|
||||
}
|
||||
}
|
||||
else
|
||||
nothing = TRUE;
|
||||
|
|
@ -321,28 +306,7 @@ ApplyRetrieveRule(Query *parsetree,
|
|||
}
|
||||
rt_length = length(rtable);
|
||||
|
||||
if (viewAclOverride)
|
||||
{
|
||||
List *rule_rtable,
|
||||
*rule_rt;
|
||||
RangeTblEntry *rte;
|
||||
|
||||
rule_rtable = copyObject(rule_action->rtable);
|
||||
foreach(rule_rt, rule_rtable)
|
||||
{
|
||||
rte = lfirst(rule_rt);
|
||||
|
||||
/*
|
||||
* tell the executor that the ACL check on this range table
|
||||
* entry is already done
|
||||
*/
|
||||
rte->skipAcl = true;
|
||||
}
|
||||
|
||||
rtable = nconc(rtable, rule_rtable);
|
||||
}
|
||||
else
|
||||
rtable = nconc(rtable, copyObject(rule_action->rtable));
|
||||
rtable = nconc(rtable, copyObject(rule_action->rtable));
|
||||
parsetree->rtable = rtable;
|
||||
|
||||
rule_action->rtable = rtable;
|
||||
|
|
@ -425,6 +389,8 @@ ProcessRetrieveQuery(Query *parsetree,
|
|||
if (rule)
|
||||
return NIL;
|
||||
|
||||
rt_index = 0;
|
||||
|
||||
foreach(rt, rtable)
|
||||
{
|
||||
RangeTblEntry *rt_entry = lfirst(rt);
|
||||
|
|
@ -537,6 +503,44 @@ fireRules(Query *parsetree,
|
|||
List *r;
|
||||
bool orig_instead_flag = *instead_flag;
|
||||
|
||||
/*
|
||||
* Instead rules change the resultRelation of the
|
||||
* query. So the permission checks on the initial
|
||||
* resultRelation would never be done (this is
|
||||
* normally done in the executor deep down). So
|
||||
* we must do it here. The result relations resulting
|
||||
* from earlier rewrites are already checked against
|
||||
* the rules eventrelation owner (during matchLocks)
|
||||
* and have the skipAcl flag set.
|
||||
*/
|
||||
if (rule_lock->isInstead &&
|
||||
parsetree->commandType != CMD_SELECT) {
|
||||
RangeTblEntry *rte;
|
||||
int32 acl_rc;
|
||||
int32 reqperm;
|
||||
|
||||
switch (parsetree->commandType) {
|
||||
case CMD_INSERT:
|
||||
reqperm = ACL_AP;
|
||||
break;
|
||||
default:
|
||||
reqperm = ACL_WR;
|
||||
break;
|
||||
}
|
||||
|
||||
rte = (RangeTblEntry *)nth(parsetree->resultRelation - 1,
|
||||
parsetree->rtable);
|
||||
if (!rte->skipAcl) {
|
||||
acl_rc = pg_aclcheck(rte->relname,
|
||||
GetPgUserName(), reqperm);
|
||||
if (acl_rc != ACLCHECK_OK) {
|
||||
elog(ERROR, "%s: %s",
|
||||
rte->relname,
|
||||
aclcheck_error_strings[acl_rc]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* multiple rule action time */
|
||||
*instead_flag = rule_lock->isInstead;
|
||||
event_qual = rule_lock->qual;
|
||||
|
|
@ -1024,42 +1028,3 @@ deepRewriteQuery(Query *parsetree)
|
|||
|
||||
return rewritten;
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
CheckViewPerms(Relation view, List *rtable)
|
||||
{
|
||||
HeapTuple utup;
|
||||
NameData uname;
|
||||
List *rt;
|
||||
RangeTblEntry *rte;
|
||||
int32 aclcheck_res;
|
||||
|
||||
/*
|
||||
* get the usename of the view's owner
|
||||
*/
|
||||
utup = SearchSysCacheTuple(USESYSID,
|
||||
ObjectIdGetDatum(view->rd_rel->relowner),
|
||||
0, 0, 0);
|
||||
if (!HeapTupleIsValid(utup))
|
||||
{
|
||||
elog(ERROR, "cache lookup for userid %d failed",
|
||||
view->rd_rel->relowner);
|
||||
}
|
||||
StrNCpy(uname.data,
|
||||
((Form_pg_shadow) GETSTRUCT(utup))->usename.data,
|
||||
NAMEDATALEN);
|
||||
|
||||
/*
|
||||
* check that we have read access to all the classes in the range
|
||||
* table of the view
|
||||
*/
|
||||
foreach(rt, rtable)
|
||||
{
|
||||
rte = (RangeTblEntry *) lfirst(rt);
|
||||
|
||||
aclcheck_res = pg_aclcheck(rte->relname, uname.data, ACL_RD);
|
||||
if (aclcheck_res != ACLCHECK_OK)
|
||||
elog(ERROR, "%s: %s", rte->relname, aclcheck_error_strings[aclcheck_res]);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
*
|
||||
*
|
||||
* IDENTIFICATION
|
||||
* $Header: /cvsroot/pgsql/src/backend/rewrite/rewriteSupport.c,v 1.25 1998/08/19 02:02:33 momjian Exp $
|
||||
* $Header: /cvsroot/pgsql/src/backend/rewrite/rewriteSupport.c,v 1.26 1998/08/24 01:38:01 momjian Exp $
|
||||
*
|
||||
*-------------------------------------------------------------------------
|
||||
*/
|
||||
|
|
@ -158,6 +158,10 @@ prs2_addToRelation(Oid relid,
|
|||
*/
|
||||
oldcxt = MemoryContextSwitchTo((MemoryContext) CacheCxt);
|
||||
thisRule = (RewriteRule *) palloc(sizeof(RewriteRule));
|
||||
if (qual != NULL)
|
||||
qual = copyObject(qual);
|
||||
if (actions != NIL)
|
||||
actions = copyObject(actions);
|
||||
MemoryContextSwitchTo(oldcxt);
|
||||
|
||||
thisRule->ruleId = ruleId;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
*
|
||||
*
|
||||
* IDENTIFICATION
|
||||
* $Header: /cvsroot/pgsql/src/backend/tcop/postgres.c,v 1.82 1998/08/04 16:44:20 momjian Exp $
|
||||
* $Header: /cvsroot/pgsql/src/backend/tcop/postgres.c,v 1.83 1998/08/24 01:38:02 momjian Exp $
|
||||
*
|
||||
* NOTES
|
||||
* this is the "main" module of the postgres backend and
|
||||
|
|
@ -380,7 +380,8 @@ pg_parse_and_plan(char *query_string, /* string to execute */
|
|||
int nargs, /* number of arguments */
|
||||
QueryTreeList **queryListP, /* pointer to the parse
|
||||
* trees */
|
||||
CommandDest dest) /* where results should go */
|
||||
CommandDest dest, /* where results should go */
|
||||
bool aclOverride)
|
||||
{
|
||||
QueryTreeList *querytree_list;
|
||||
int i;
|
||||
|
|
@ -451,24 +452,24 @@ pg_parse_and_plan(char *query_string, /* string to execute */
|
|||
/* rewrite queries (retrieve, append, delete, replace) */
|
||||
rewritten = QueryRewrite(querytree);
|
||||
|
||||
/*
|
||||
* Rewrite the UNIONS.
|
||||
*/
|
||||
foreach(rewritten_list, rewritten)
|
||||
{
|
||||
Query *qry = (Query *) lfirst(rewritten_list);
|
||||
|
||||
union_result = NIL;
|
||||
foreach(union_list, qry->unionClause)
|
||||
union_result = nconc(union_result, QueryRewrite((Query *) lfirst(union_list)));
|
||||
qry->unionClause = union_result;
|
||||
}
|
||||
|
||||
if (rewritten != NULL)
|
||||
if (rewritten != NIL)
|
||||
{
|
||||
int len,
|
||||
k;
|
||||
|
||||
/*
|
||||
* Rewrite the UNIONS.
|
||||
*/
|
||||
foreach(rewritten_list, rewritten)
|
||||
{
|
||||
Query *qry = (Query *) lfirst(rewritten_list);
|
||||
|
||||
union_result = NIL;
|
||||
foreach(union_list, qry->unionClause)
|
||||
union_result = nconc(union_result, QueryRewrite((Query *) lfirst(union_list)));
|
||||
qry->unionClause = union_result;
|
||||
}
|
||||
|
||||
len = length(rewritten);
|
||||
if (len == 1)
|
||||
new_list->qtrees[j++] = (Query *) lfirst(rewritten);
|
||||
|
|
@ -487,12 +488,40 @@ pg_parse_and_plan(char *query_string, /* string to execute */
|
|||
}
|
||||
}
|
||||
|
||||
/* ----------
|
||||
* Due to rewriting, the new list could also have been
|
||||
* shrunk (do instead nothing). Forget obsolete queries
|
||||
* at the end.
|
||||
* ----------
|
||||
*/
|
||||
new_list->len = j;
|
||||
|
||||
/* we're done with the original lists, free it */
|
||||
free(querytree_list->qtrees);
|
||||
free(querytree_list);
|
||||
|
||||
querytree_list = new_list;
|
||||
|
||||
/*
|
||||
* Override ACL checking if requested
|
||||
*/
|
||||
if (aclOverride) {
|
||||
for (i = 0; i < querytree_list->len; i++) {
|
||||
RangeTblEntry *rte;
|
||||
List *l;
|
||||
|
||||
querytree = querytree_list->qtrees[i];
|
||||
if (querytree->commandType == CMD_UTILITY)
|
||||
continue;
|
||||
|
||||
foreach (l, querytree->rtable) {
|
||||
rte = (RangeTblEntry *)lfirst(l);
|
||||
|
||||
rte->skipAcl = TRUE;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (DebugPrintRewrittenParsetree == true)
|
||||
{
|
||||
printf("\n---- \tafter rewriting:\n");
|
||||
|
|
@ -530,7 +559,10 @@ pg_parse_and_plan(char *query_string, /* string to execute */
|
|||
elog(NOTICE, "(transaction aborted): %s",
|
||||
"queries ignored until END");
|
||||
|
||||
*queryListP = (QueryTreeList *) NULL;
|
||||
free(querytree_list->qtrees);
|
||||
free(querytree_list);
|
||||
if (queryListP)
|
||||
*queryListP = (QueryTreeList *) NULL;
|
||||
return (List *) NULL;
|
||||
}
|
||||
|
||||
|
|
@ -573,6 +605,16 @@ pg_parse_and_plan(char *query_string, /* string to execute */
|
|||
#endif
|
||||
}
|
||||
|
||||
/* ----------
|
||||
* Check if the rewriting had thrown away anything
|
||||
* ----------
|
||||
*/
|
||||
if (querytree_list->len == 0) {
|
||||
free(querytree_list->qtrees);
|
||||
free(querytree_list);
|
||||
querytree_list = NULL;
|
||||
}
|
||||
|
||||
if (queryListP)
|
||||
*queryListP = querytree_list;
|
||||
|
||||
|
|
@ -599,12 +641,22 @@ pg_parse_and_plan(char *query_string, /* string to execute */
|
|||
void
|
||||
pg_exec_query(char *query_string)
|
||||
{
|
||||
pg_exec_query_dest(query_string, whereToSendOutput);
|
||||
pg_exec_query_dest(query_string, whereToSendOutput, FALSE);
|
||||
}
|
||||
|
||||
void
|
||||
pg_exec_query_acl_override(char *query_string)
|
||||
{
|
||||
pg_exec_query_dest(query_string, whereToSendOutput, TRUE);
|
||||
}
|
||||
|
||||
void
|
||||
pg_exec_query_dest(char *query_string, /* string to execute */
|
||||
CommandDest dest) /* where results should go */
|
||||
CommandDest dest, /* where results should go */
|
||||
bool aclOverride) /* to give utility
|
||||
* commands power of
|
||||
* superusers
|
||||
*/
|
||||
{
|
||||
List *plan_list;
|
||||
Plan *plan;
|
||||
|
|
@ -614,7 +666,7 @@ pg_exec_query_dest(char *query_string, /* string to execute */
|
|||
QueryTreeList *querytree_list;
|
||||
|
||||
/* plan the queries */
|
||||
plan_list = pg_parse_and_plan(query_string, NULL, 0, &querytree_list, dest);
|
||||
plan_list = pg_parse_and_plan(query_string, NULL, 0, &querytree_list, dest, aclOverride);
|
||||
|
||||
if (QueryCancel)
|
||||
CancelQuery();
|
||||
|
|
@ -1339,7 +1391,7 @@ PostgresMain(int argc, char *argv[], int real_argc, char *real_argv[])
|
|||
if (!IsUnderPostmaster)
|
||||
{
|
||||
puts("\nPOSTGRES backend interactive interface");
|
||||
puts("$Revision: 1.82 $ $Date: 1998/08/04 16:44:20 $");
|
||||
puts("$Revision: 1.83 $ $Date: 1998/08/24 01:38:02 $");
|
||||
}
|
||||
|
||||
/* ----------------
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
# Makefile for utils/adt
|
||||
#
|
||||
# IDENTIFICATION
|
||||
# $Header: /cvsroot/pgsql/src/backend/utils/adt/Makefile,v 1.16 1998/08/19 02:02:52 momjian Exp $
|
||||
# $Header: /cvsroot/pgsql/src/backend/utils/adt/Makefile,v 1.17 1998/08/24 01:38:04 momjian Exp $
|
||||
#
|
||||
#-------------------------------------------------------------------------
|
||||
|
||||
|
|
@ -22,8 +22,8 @@ OBJS = acl.o arrayfuncs.o arrayutils.o bool.o cash.o char.o chunk.o \
|
|||
geo_ops.o geo_selfuncs.o int.o int8.o like.o \
|
||||
misc.o nabstime.o name.o not_in.o numutils.o \
|
||||
oid.o oracle_compat.o \
|
||||
regexp.o regproc.o selfuncs.o sets.o tid.o timestamp.o \
|
||||
varchar.o varlena.o version.o
|
||||
regexp.o regproc.o ruleutils.o selfuncs.o sets.o \
|
||||
tid.o timestamp.o varchar.o varlena.o version.o
|
||||
|
||||
all: SUBSYS.o
|
||||
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load Diff
|
|
@ -26,7 +26,7 @@
|
|||
#
|
||||
#
|
||||
# IDENTIFICATION
|
||||
# $Header: /cvsroot/pgsql/src/bin/initdb/Attic/initdb.sh,v 1.53 1998/08/24 01:14:04 momjian Exp $
|
||||
# $Header: /cvsroot/pgsql/src/bin/initdb/Attic/initdb.sh,v 1.54 1998/08/24 01:38:06 momjian Exp $
|
||||
#
|
||||
#-------------------------------------------------------------------------
|
||||
|
||||
|
|
@ -433,6 +433,39 @@ echo "CREATE RULE _RETpg_user AS ON SELECT TO pg_user DO INSTEAD \
|
|||
echo "REVOKE ALL on pg_shadow FROM public" | \
|
||||
postgres $PGSQL_OPT template1 > /dev/null
|
||||
|
||||
echo "Creating view pg_rule"
|
||||
echo "CREATE TABLE xpg_rule ( \
|
||||
rulename name, \
|
||||
definition text);" | postgres $PGSQL_OPT template1 > /dev/null
|
||||
#move it into pg_rule
|
||||
echo "UPDATE pg_class SET relname = 'pg_rule' WHERE relname = 'xpg_rule';" |\
|
||||
postgres $PGSQL_OPT template1 > /dev/null
|
||||
echo "UPDATE pg_type SET typname = 'pg_rule' WHERE typname = 'xpg_rule';" |\
|
||||
postgres $PGSQL_OPT template1 > /dev/null
|
||||
mv $PGDATA/base/template1/xpg_rule $PGDATA/base/template1/pg_rule
|
||||
|
||||
echo "CREATE RULE _RETpg_rule AS ON SELECT TO pg_rule DO INSTEAD \
|
||||
SELECT rulename, pg_get_ruledef(rulename) AS definition \
|
||||
FROM pg_rewrite;" | postgres $PGSQL_OPT template1 > /dev/null
|
||||
|
||||
echo "Creating view pg_view"
|
||||
echo "CREATE TABLE xpg_view ( \
|
||||
viewname name, \
|
||||
definition text);" | postgres $PGSQL_OPT template1 > /dev/null
|
||||
#move it into pg_view
|
||||
echo "UPDATE pg_class SET relname = 'pg_view' WHERE relname = 'xpg_view';" |\
|
||||
postgres $PGSQL_OPT template1 > /dev/null
|
||||
echo "UPDATE pg_type SET typname = 'pg_view' WHERE typname = 'xpg_view';" |\
|
||||
postgres $PGSQL_OPT template1 > /dev/null
|
||||
mv $PGDATA/base/template1/xpg_view $PGDATA/base/template1/pg_view
|
||||
|
||||
echo "CREATE RULE _RETpg_view AS ON SELECT TO pg_view DO INSTEAD \
|
||||
SELECT relname AS viewname, \
|
||||
pg_get_viewdef(relname) AS definition \
|
||||
FROM pg_class WHERE relhasrules AND \
|
||||
pg_get_viewdef(relname) != 'Not a view';" | \
|
||||
postgres $PGSQL_OPT template1 > /dev/null
|
||||
|
||||
echo "Loading pg_description"
|
||||
echo "copy pg_description from '$TEMPLATE_DESCR'" | \
|
||||
postgres $PGSQL_OPT template1 > /dev/null
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
*
|
||||
* Copyright (c) 1994, Regents of the University of California
|
||||
*
|
||||
* $Id: pg_proc.h,v 1.66 1998/08/19 02:03:54 momjian Exp $
|
||||
* $Id: pg_proc.h,v 1.67 1998/08/24 01:38:08 momjian Exp $
|
||||
*
|
||||
* NOTES
|
||||
* The script catalog/genbki.sh reads this file and generates .bki
|
||||
|
|
@ -2033,6 +2033,12 @@ DESCR("sequence current value");
|
|||
/* for multi-byte support */
|
||||
DATA(insert OID = 1039 ( getdatabaseencoding PGUID 11 f t f 0 f 19 "0" 100 0 0 100 foo bar ));
|
||||
|
||||
/* System-view support functions */
|
||||
DATA(insert OID = 1640 ( pg_get_ruledef PGUID 11 f t f 1 f 25 "19" 100 0 0 100 foo bar ));
|
||||
DESCR("source text of a rule");
|
||||
DATA(insert OID = 1641 ( pg_get_viewdef PGUID 11 f t f 1 f 25 "19" 100 0 0 100 foo bar ));
|
||||
DESCR("select statement of a view");
|
||||
|
||||
/*
|
||||
* prototypes for functions pg_proc.c
|
||||
*/
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
*
|
||||
* Copyright (c) 1994, Regents of the University of California
|
||||
*
|
||||
* $Id: tcopprot.h,v 1.14 1998/06/04 17:26:49 momjian Exp $
|
||||
* $Id: tcopprot.h,v 1.15 1998/08/24 01:38:11 momjian Exp $
|
||||
*
|
||||
* OLD COMMENTS
|
||||
* This file was created so that other c files could get the two
|
||||
|
|
@ -24,10 +24,12 @@
|
|||
#ifndef BOOTSTRAP_INCLUDE
|
||||
extern List *
|
||||
pg_parse_and_plan(char *query_string, Oid *typev, int nargs,
|
||||
QueryTreeList **queryListP, CommandDest dest);
|
||||
QueryTreeList **queryListP, CommandDest dest,
|
||||
bool aclOverride);
|
||||
extern void pg_exec_query(char *query_string);
|
||||
extern void pg_exec_query_acl_override(char *query_string);
|
||||
extern void
|
||||
pg_exec_query_dest(char *query_string, CommandDest dest);
|
||||
pg_exec_query_dest(char *query_string, CommandDest dest, bool aclOverride);
|
||||
|
||||
#endif /* BOOTSTRAP_HEADER */
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue