Re: improving user.c error messages
От | Nathan Bossart |
---|---|
Тема | Re: improving user.c error messages |
Дата | |
Msg-id | 20230316162749.GA792895@nathanxps13 обсуждение исходный текст |
Ответ на | Re: improving user.c error messages (Peter Eisentraut <peter.eisentraut@enterprisedb.com>) |
Ответы |
Re: improving user.c error messages
|
Список | pgsql-hackers |
On Thu, Mar 16, 2023 at 04:59:53PM +0100, Peter Eisentraut wrote: > On 16.03.23 16:48, Nathan Bossart wrote: >> > I think the following change in DropRole() is incorrect: >> > >> > if (!is_admin_of_role(GetUserId(), roleid)) >> > ereport(ERROR, >> > (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), >> > - errmsg("must have admin option on role \"%s\"", >> > - role))); >> > + errmsg("permission denied to drop role"), >> > + errdetail("Only roles with the %s attribute and the %s >> > option on role \"%s\" may drop this role.", >> > + "CREATEROLE", "ADMIN", >> > NameStr(roleform->rolname)))); >> > >> > The message does not reflect what check is actually performed. (Perhaps >> > this was confused with a similar but not exactly the same check in >> > RenameRole().) >> Hm. Is your point that we should only mention the admin option here? I >> mentioned both createrole and admin option in this message (and the >> createrole check above this point) in an attempt to avoid giving partial >> information. > > AFAICT, the mention of CREATEROLE is incorrect, because the code doesn't > actually check for the CREATEROLE attribute. There is a createrole check at the top of DropRole(): /* * DROP ROLE */ void DropRole(DropRoleStmt *stmt) { Relation pg_authid_rel, pg_auth_members_rel; ListCell *item; List *role_addresses = NIL; if (!have_createrole_privilege()) ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), errmsg("permission denied to drop role"))); Granted, no one will see the admin option error unless they at least have createrole, so we could leave it out, but my intent was to list the full set of privileges required to drop the role to avoid ambiguity. -- Nathan Bossart Amazon Web Services: https://aws.amazon.com
В списке pgsql-hackers по дате отправления: