diff options
| author | Robert Haas <rhaas@postgresql.org> | 2022-08-30 08:32:35 -0400 |
|---|---|---|
| committer | Robert Haas <rhaas@postgresql.org> | 2022-08-31 08:22:24 -0400 |
| commit | 0101f770a05b07dd7a8e05b6f8f95d4e22f4e846 (patch) | |
| tree | 9b1525bac172bf736afc43aaa7d2471aecfe1368 /src/backend/utils/adt/acl.c | |
| parent | c7892c253fdc7bcb99a61e820798588ee4c071b9 (diff) | |
Fix a bug in roles_is_member_of.
Commit e3ce2de09d814f8770b2e3b3c152b7671bcdb83f rearranged this
function to be able to identify which inherited role had admin option
on the target role, but it got the order of operations wrong, causing
the function to return wrong answers in the presence of non-inherited
grants.
Fix that, and add a test case that verifies the correct behavior.
Patch by me, reviewed by Nathan Bossart
Discussion: http://postgr.es/m/CA+TgmoYamnu-xt-u7CqjYWnRiJ6BQaSpYOHXP=r4QGTfd1N_EA@mail.gmail.com
Diffstat (limited to 'src/backend/utils/adt/acl.c')
| -rw-r--r-- | src/backend/utils/adt/acl.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/backend/utils/adt/acl.c b/src/backend/utils/adt/acl.c index ea28da26a89..fd71a9b13e9 100644 --- a/src/backend/utils/adt/acl.c +++ b/src/backend/utils/adt/acl.c @@ -4852,10 +4852,6 @@ roles_is_member_of(Oid roleid, enum RoleRecurseType type, Form_pg_auth_members form = (Form_pg_auth_members) GETSTRUCT(tup); Oid otherid = form->roleid; - /* If we're supposed to ignore non-heritable grants, do so. */ - if (type == ROLERECURSE_PRIVS && !form->inherit_option) - continue; - /* * While otherid==InvalidOid shouldn't appear in the catalog, the * OidIsValid() avoids crashing if that arises. @@ -4864,6 +4860,10 @@ roles_is_member_of(Oid roleid, enum RoleRecurseType type, OidIsValid(admin_of) && !OidIsValid(*admin_role)) *admin_role = memberid; + /* If we're supposed to ignore non-heritable grants, do so. */ + if (type == ROLERECURSE_PRIVS && !form->inherit_option) + continue; + /* * Even though there shouldn't be any loops in the membership * graph, we must test for having already seen this role. It is |