Patch from Massimo Dal Zotto <dz@cs.unitn.it>

scrappy · scrappy · commit 1e5755cf7334 · 1997-01-23T19:33:31.000Z
The first patch changes the behavior of aclcheck for groups. Currently an user
can access a table only if he has the required permission for ALL the groups
defined for that table. With my patch he can access a table if he has the
permission for ONE of the groups, which seems to me a more useful thing.
If you think this should be the correct behavior of the acl group check feel
free to remove the #ifdef, if not please add a commented line to config.h.
diff --git a/src/backend/tcop/aclchk.c b/src/backend/tcop/aclchk.c
@@ -7,7 +7,7 @@
  *
  *
  * IDENTIFICATION
- *    $Header: /cvsroot/pgsql/src/backend/tcop/Attic/aclchk.c,v 1.5 1996/11/30 18:06:45 momjian Exp $
+ *    $Header: /cvsroot/pgsql/src/backend/tcop/Attic/aclchk.c,v 1.6 1997/01/23 19:33:31 scrappy Exp $
  *
  * NOTES
  *    See acl.h.
@@ -291,6 +291,12 @@ aclcheck(Acl *acl, AclId id, AclIdType idtype, AclMode mode)
 	     i < num && aip->ai_idtype == ACL_IDTYPE_GID;
 	     ++i, ++aip) {
 	    if (in_group(id, aip->ai_id)) {
+#ifdef ACLGROUP_PATCH
+		if (aip->ai_mode & mode) {
+		    found_group = 1;
+                    break;
+		}
+#else
 		if (aip->ai_mode & mode)
 		    ++found_group;
 		else {
@@ -300,6 +306,7 @@ aclcheck(Acl *acl, AclId id, AclIdType idtype, AclMode mode)
 #endif
 		    return(0);
 		}
+#endif
 	    }
 	}
 	if (found_group) {

Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@`
`7`	`7`	`*`
`8`	`8`	`*`
`9`	`9`	`* IDENTIFICATION`
`10`		`- * $Header: /cvsroot/pgsql/src/backend/tcop/Attic/aclchk.c,v 1.5 1996/11/30 18:06:45 momjian Exp $`
	`10`	`+ * $Header: /cvsroot/pgsql/src/backend/tcop/Attic/aclchk.c,v 1.6 1997/01/23 19:33:31 scrappy Exp $`
`11`	`11`	`*`
`12`	`12`	`* NOTES`
`13`	`13`	`* See acl.h.`
`@@ -291,6 +291,12 @@ aclcheck(Acl *acl, AclId id, AclIdType idtype, AclMode mode)`
`291`	`291`	`i < num && aip->ai_idtype == ACL_IDTYPE_GID;`
`292`	`292`	`++i, ++aip) {`
`293`	`293`	`if (in_group(id, aip->ai_id)) {`
	`294`	`+#ifdef ACLGROUP_PATCH`
	`295`	`+ if (aip->ai_mode & mode) {`
	`296`	`+ found_group = 1;`
	`297`	`+ break;`
	`298`	`+ }`
	`299`	`+#else`
`294`	`300`	`if (aip->ai_mode & mode)`
`295`	`301`	`++found_group;`
`296`	`302`	`else {`
`@@ -300,6 +306,7 @@ aclcheck(Acl *acl, AclId id, AclIdType idtype, AclMode mode)`
`300`	`306`	`#endif`
`301`	`307`	`return(0);`
`302`	`308`	`}`
	`309`	`+#endif`
`303`	`310`	`}`
`304`	`311`	`}`
`305`	`312`	`if (found_group) {`