Hi all,
From what I've seen in the archives, questions like this have kind of
been answered in the past, but I was wondering if there have been any
changes in this area, or if anyone has good ideas on how to do what I'm
about to ask :)
In RDBMSs such as Oracle, stored PL/SQL functions run with the
permissions of the user that creates the function. Users who are given
EXECUTE privileges then call the function with the permissions of the
creator of the function.
Is this how things work with PL/pgSQL in PostgreSQL? From my
understanding, the answer is 'no.' If the answer really is 'no,' then
how do I achieve the same thing?
The main benefit for this is in security - I have a dynamic web
application that requires (a lot of) access to a PostgreSQL database. I
want to make sure that the user doesn't have direct access to change
the content of tables, but rather to alter their contents, in
predetermined ways, through a set of functions. It's another layer that
protects against hacking, and because my project involves a lot of
monetary transactions (and database transactions), I want to reduce my
potential for malicious abuse.
Many thanks in advance for you help,
Paul