INSERT possible without INSERT-permission

Gert Pache (uhx2@rz.uni-karlsruhe.de) reports a bug with a severity of 3
The lower the number the more severe it is.

Short Description
INSERT possible without INSERT-permission

Long Description
Although a user without has only UPDATE/DELETE-permissions on a table he can insert into the table.

Version: 7.0.1

Sample Code
-- superuser creates tables tab und grants user pgtester only
-- update-permission

delme=# create table tab ( id int );
CREATE
delme=# revoke all on tab from public;
CHANGE
delme=# grant update on tab to pgtester;
CHANGE
delme=# \dp tab
Access permissions for database "delme"
 Relation | Access permissions
----------+--------------------
 tab      | {"=","pgtester=w"}


-- although not having insert permission, pgtester is able
-- to insert a record
delme=> insert into tab values (1);
INSERT 76448 1
-- SELECTs are forbidden as they should be
delme=> select * from tab;
ERROR:  tab: Permission denied.



No file was uploaded with this report