Search Postgresql Archives

Re: SET LOCAL ROLE inside SECURITY INVOKER (LANGUAGE plpgsql) function

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 2025-Jul-31, Dominique Devienne wrote:

> But also, it's weird DELETE allows you to delete all rows.
> Yet prevents you from deleting just one, i.e. a subset.

But you don't know what you deleted, so you cannot exfiltrate useful
info by repeatedly deleting with varying WHERE values.  I suspect that
you aren't able to use DELETE RETURNING either, unless you have SELECT
privs.

> I get it, a WHERE needs to read, so needs SELECT.

Right.

-- 
Álvaro Herrera         PostgreSQL Developer  —  https://www.EnterpriseDB.com/
"El destino baraja y nosotros jugamos" (A. Schopenhauer)





[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Postgresql Jobs]     [Postgresql Admin]     [Postgresql Performance]     [Linux Clusters]     [PHP Home]     [PHP on Windows]     [Kernel Newbies]     [PHP Classes]     [PHP Databases]     [Postgresql & PHP]     [Yosemite]

  Powered by Linux