From 3cf62ecd2e9e23d4d3292c1f21e093c698080f33 Mon Sep 17 00:00:00 2001 From: Raul Ochoa Date: Tue, 10 Feb 2015 15:27:42 +0100 Subject: [PATCH] Do not grant select permission to public user - Fake the behaviour in tests by switching between users --- expected/test_ddl_triggers.out | 12 ++++++++++++ scripts-available/CDB_TableMetadata.sql | 6 +++--- sql/test_ddl_triggers.sql | 16 +++++++++++++--- 3 files changed, 28 insertions(+), 6 deletions(-) diff --git a/expected/test_ddl_triggers.out b/expected/test_ddl_triggers.out index 3380717..737468a 100644 --- a/expected/test_ddl_triggers.out +++ b/expected/test_ddl_triggers.out @@ -32,6 +32,7 @@ SET SESSION AUTHORIZATION 'cartodb_postgresql_unpriv_user'; ---------------------- -- CREATE TABLE ---------------------- +SET SESSION AUTHORIZATION 'cartodb_postgresql_unpriv_user'; select 1 as i INTO c.t3; NOTICE: trigger "track_updates" for table "c.t3" does not exist, skipping NOTICE: trigger "update_the_geom_webmercator_trigger" for table "c.t3" does not exist, skipping @@ -55,6 +56,7 @@ from c.t3; 1 | t | t | | | 1 (1 row) +RESET SESSION AUTHORIZATION; select tabname::text, round(extract('secs' from now() - updated_at)) as age @@ -64,6 +66,7 @@ FROM CDB_TableMetadata WHERE tabname = 'c.t3'::regclass; c.t3 | 0 (1 row) +SET SESSION AUTHORIZATION 'cartodb_postgresql_unpriv_user'; -- Table with cartodb_id field, see -- http://github.com/CartoDB/cartodb-postgresql/issues/32 select 1 as cartodb_id INTO c.t4; @@ -91,6 +94,7 @@ from c.t4; 1 | t | t | | (1 row) +RESET SESSION AUTHORIZATION; select tabname::text, round(extract('secs' from now() - updated_at)) as age @@ -103,6 +107,7 @@ FROM CDB_TableMetadata WHERE tabname = 'c.t4'::regclass; ---------------------------- -- ALTER TABLE RENAME COLUMN ---------------------------- +SET SESSION AUTHORIZATION 'cartodb_postgresql_unpriv_user'; select pg_sleep(.1); pg_sleep ---------- @@ -131,6 +136,7 @@ from c.t3; 1 | t | t | | | 1 | (1 row) +RESET SESSION AUTHORIZATION; select tabname::text, round(extract('secs' from now() - updated_at)*10) as agecs @@ -140,6 +146,7 @@ FROM CDB_TableMetadata WHERE tabname = 'c.t3'::regclass; c.t3 | 0 (1 row) +SET SESSION AUTHORIZATION 'cartodb_postgresql_unpriv_user'; select pg_sleep(.1); pg_sleep ---------- @@ -168,6 +175,7 @@ from c.t3; 1 | t | t | | | 1 | | (1 row) +RESET SESSION AUTHORIZATION; select tabname::text, round(extract('secs' from now() - updated_at)*10) as agecs @@ -180,6 +188,7 @@ FROM CDB_TableMetadata WHERE tabname = 'c.t3'::regclass; ---------------------------- -- ALTER TABLE DROP COLUMN ---------------------------- +SET SESSION AUTHORIZATION 'cartodb_postgresql_unpriv_user'; select pg_sleep(.1); pg_sleep ---------- @@ -208,6 +217,7 @@ from c.t3; 1 | t | t | | | 1 | | (1 row) +RESET SESSION AUTHORIZATION; select tabname::text, round(extract('secs' from now() - updated_at)*10) as agecs @@ -220,6 +230,7 @@ FROM CDB_TableMetadata WHERE tabname = 'c.t3'::regclass; ---------------------------- -- ALTER TABLE ADD COLUMN ---------------------------- +SET SESSION AUTHORIZATION 'cartodb_postgresql_unpriv_user'; select pg_sleep(.1); pg_sleep ---------- @@ -239,6 +250,7 @@ from c.t3; 1 | t | t | | | 1 | | | (1 row) +RESET SESSION AUTHORIZATION; select tabname::text, round(extract('secs' from now() - updated_at)*10) as agecs diff --git a/scripts-available/CDB_TableMetadata.sql b/scripts-available/CDB_TableMetadata.sql index 9fcf3d1..745abd9 100644 --- a/scripts-available/CDB_TableMetadata.sql +++ b/scripts-available/CDB_TableMetadata.sql @@ -5,9 +5,9 @@ CREATE TABLE IF NOT EXISTS updated_at timestamp with time zone not null default now() ); --- Anyone can see this, but updates are only possible trough --- the security definer trigger -GRANT SELECT ON public.CDB_TableMetadata TO public; +-- No one can see this +-- Updates are only possible trough the security definer trigger +-- GRANT SELECT ON public.CDB_TableMetadata TO public; -- -- Trigger logging updated_at in the CDB_TableMetadata diff --git a/sql/test_ddl_triggers.sql b/sql/test_ddl_triggers.sql index 4259914..df5c3a4 100644 --- a/sql/test_ddl_triggers.sql +++ b/sql/test_ddl_triggers.sql @@ -18,7 +18,7 @@ SET SESSION AUTHORIZATION 'cartodb_postgresql_unpriv_user'; ---------------------- -- CREATE TABLE ---------------------- - +SET SESSION AUTHORIZATION 'cartodb_postgresql_unpriv_user'; select 1 as i INTO c.t3; select @@ -28,11 +28,13 @@ select i from c.t3; +RESET SESSION AUTHORIZATION; select tabname::text, round(extract('secs' from now() - updated_at)) as age FROM CDB_TableMetadata WHERE tabname = 'c.t3'::regclass; +SET SESSION AUTHORIZATION 'cartodb_postgresql_unpriv_user'; -- Table with cartodb_id field, see -- http://github.com/CartoDB/cartodb-postgresql/issues/32 select 1 as cartodb_id INTO c.t4; @@ -41,6 +43,8 @@ select NOW() - updated_at < '1 secs' as "u<1s", the_geom, the_geom_webmercator from c.t4; + +RESET SESSION AUTHORIZATION; select tabname::text, round(extract('secs' from now() - updated_at)) as age @@ -49,6 +53,7 @@ FROM CDB_TableMetadata WHERE tabname = 'c.t4'::regclass; ---------------------------- -- ALTER TABLE RENAME COLUMN ---------------------------- +SET SESSION AUTHORIZATION 'cartodb_postgresql_unpriv_user'; select pg_sleep(.1); alter table c.t3 rename column the_geom_webmercator to webmerc; @@ -60,11 +65,13 @@ select i, webmerc from c.t3; +RESET SESSION AUTHORIZATION; select tabname::text, round(extract('secs' from now() - updated_at)*10) as agecs FROM CDB_TableMetadata WHERE tabname = 'c.t3'::regclass; +SET SESSION AUTHORIZATION 'cartodb_postgresql_unpriv_user'; select pg_sleep(.1); alter table c.t3 rename column the_geom_webmercator to webmerc2; @@ -75,6 +82,7 @@ select i, webmerc, webmerc2 from c.t3; +RESET SESSION AUTHORIZATION; select tabname::text, round(extract('secs' from now() - updated_at)*10) as agecs @@ -83,7 +91,7 @@ FROM CDB_TableMetadata WHERE tabname = 'c.t3'::regclass; ---------------------------- -- ALTER TABLE DROP COLUMN ---------------------------- - +SET SESSION AUTHORIZATION 'cartodb_postgresql_unpriv_user'; select pg_sleep(.1); alter table c.t3 drop column the_geom_webmercator; @@ -94,6 +102,7 @@ select i, webmerc, webmerc2 from c.t3; +RESET SESSION AUTHORIZATION; select tabname::text, round(extract('secs' from now() - updated_at)*10) as agecs @@ -102,7 +111,7 @@ FROM CDB_TableMetadata WHERE tabname = 'c.t3'::regclass; ---------------------------- -- ALTER TABLE ADD COLUMN ---------------------------- - +SET SESSION AUTHORIZATION 'cartodb_postgresql_unpriv_user'; select pg_sleep(.1); alter table c.t3 add column id2 int; @@ -113,6 +122,7 @@ select i, webmerc, webmerc2, id2 from c.t3; +RESET SESSION AUTHORIZATION; select tabname::text, round(extract('secs' from now() - updated_at)*10) as agecs