Skip to content

Commit

Permalink
sql: allow user to see pg_catalog data for current database
Browse files Browse the repository at this point in the history
Release note (bug fix): Previously a user could be connected to a
database, but be unable to see the metadata for that database in
pg_catalog if the user did not have privileges (e.g. CONNECT) for the
database. Now, a user can always see the pg_catalog metadata for
the current database they are connected to.

This is needed because CockroachDB currently does not require the
CONNECT privilege to connect to a database (see
#59875).
  • Loading branch information
rafiss committed Jun 24, 2022
1 parent 9e47dc9 commit 261b898
Show file tree
Hide file tree
Showing 3 changed files with 36 additions and 3 deletions.
11 changes: 8 additions & 3 deletions pkg/sql/information_schema.go
Original file line number Diff line number Diff line change
Expand Up @@ -2162,15 +2162,20 @@ func forEachDatabaseDesc(
dbDescs = append(dbDescs, dbContext)
}

// Ignore databases that the user cannot see.
// Ignore databases that the user cannot see. We add a special case for the
// current database. This is because we currently allow a user to connect
// to a database even without the CONNECT privilege, but it would be poor
// UX to not show the current database in pg_catalog/information_schema
// tables.
// See https://github.com/cockroachdb/cockroach/issues/59875.
for _, dbDesc := range dbDescs {
canSeeDescriptor := !requiresPrivileges
if requiresPrivileges {
var err error
canSeeDescriptor, err = userCanSeeDescriptor(ctx, p, dbDesc, nil /* parentDBDesc */, false /* allowAdding */)
hasPriv, err := userCanSeeDescriptor(ctx, p, dbDesc, nil /* parentDBDesc */, false /* allowAdding */)
if err != nil {
return err
}
canSeeDescriptor = hasPriv || p.CurrentDatabase() == dbDesc.GetName()
}
if canSeeDescriptor {
if err := fn(dbDesc); err != nil {
Expand Down
4 changes: 4 additions & 0 deletions pkg/sql/logictest/testdata/logic_test/drop_view
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,9 @@ DROP VIEW testuser3
query TTTTIT
SHOW TABLES FROM test
----
public d view root 0 NULL
public testuser1 view root 0 NULL
public testuser2 view root 0 NULL

statement error cannot drop relation "testuser1" because view "testuser2" depends on it
DROP VIEW testuser1
Expand All @@ -112,6 +115,7 @@ DROP VIEW testuser1 CASCADE
query TTTTIT
SHOW TABLES FROM test
----
public d view root 0 NULL

statement error pgcode 42P01 relation "testuser2" does not exist
DROP VIEW testuser2
Expand Down
24 changes: 24 additions & 0 deletions pkg/sql/logictest/testdata/logic_test/pg_catalog
Original file line number Diff line number Diff line change
Expand Up @@ -432,6 +432,30 @@ oid nspname nspowner nspacl
1098122499 pg_extension NULL NULL
4101115737 public 2310524507 NULL

# Verify that we can still see the schemas even if we don't have any privilege
# on the current database.

statement ok
REVOKE ALL ON DATABASE test FROM public;
REVOKE ALL ON DATABASE test FROM testuser

user testuser

query OTOT colnames
SELECT * FROM pg_catalog.pg_namespace
----
oid nspname nspowner nspacl
1445254017 crdb_internal NULL NULL
155990598 information_schema NULL NULL
2154378761 pg_catalog NULL NULL
1098122499 pg_extension NULL NULL
4101115737 public 2310524507 NULL

user root

statement ok
GRANT CONNECT ON DATABASE test TO public

## pg_catalog.pg_database

query OTOITTBB colnames
Expand Down

0 comments on commit 261b898

Please sign in to comment.