Re: GRANT ON ALL IN schema
От | Bernd Helmle |
---|---|
Тема | Re: GRANT ON ALL IN schema |
Дата | |
Msg-id | 968B9B6C6E5C937958E5456C@teje обсуждение исходный текст |
Ответ на | Re: GRANT ON ALL IN schema (Peter Eisentraut <peter_e@gmx.net>) |
Список | pgsql-hackers |
--On Mittwoch, Juni 17, 2009 16:44:53 +0300 Peter Eisentraut <peter_e@gmx.net> wrote: > I think you should design this with a bit wider scope. Instead of just > "all tables in this schema", think "all tables satisfying some > condition". It has been requested, for example, to be able to grant on > all tables that match a pattern. > My experience shows that having such a thing is often leading to "bad practices". People tend to grant everything to every login role instead of using an intelligent role privilege mechanism. MySQL for example has such wildcards (using '_' and '%' wildcard patterns), which often confuses people when having such characters in their table/database names (of course, i forgot to escape them more than once). The unpredictable results of messing up a complete schema when using a broken pattern expression is going to reduce the usefulness of such a feature, i think. >> Also since this patch introduces VIEWS as object with grantable >> privileges, I added GRANT ON VIEW foo syntax which is more or less >> synonymous to GRANT ON TABLE foo syntax. It felt weird to have GRANT ON >> ALL VIEWS but not GRANT ON VIEW. > > As far as GRANT is concerned, a view is a table, so I would omit the > VIEW/VIEWS stuff completely. We have ALTER VIEW now, so why don't implement the same synonym for GRANT? -- Thanks Bernd
В списке pgsql-hackers по дате отправления: