Make currtid() functions require SELECT privileges on the target table.

While it's not clear that TID linkage info is of any great use to a
nefarious user, it's certainly unexpected that these functions wouldn't
insist on read privileges.

diff --git a/src/backend/utils/adt/tid.c b/src/backend/utils/adt/tid.c
index 5806966012c5207535e6cd0310cb5b07b176cdb1..b4ae399242c09d6bcaca3381fbdc08df828132a8 100644 (file)
--- a/src/backend/utils/adt/tid.c
+++ b/src/backend/utils/adt/tid.c
@@ -24,7 +24,9 @@
 #include "catalog/namespace.h"
 #include "catalog/pg_type.h"
 #include "libpq/pqformat.h"
+#include "miscadmin.h"
 #include "parser/parsetree.h"
+#include "utils/acl.h"
 #include "utils/builtins.h"
 
 
@@ -326,6 +328,7 @@ currtid_byreloid(PG_FUNCTION_ARGS)
        ItemPointer tid = PG_GETARG_ITEMPOINTER(1);
        ItemPointer result;
        Relation        rel;
+       AclResult       aclresult;
 
        result = (ItemPointer) palloc(sizeof(ItemPointerData));
        if (!reloid)
@@ -335,6 +338,13 @@ currtid_byreloid(PG_FUNCTION_ARGS)
        }
 
        rel = heap_open(reloid, AccessShareLock);
+
+       aclresult = pg_class_aclcheck(RelationGetRelid(rel), GetUserId(),
+                                                                 ACL_SELECT);
+       if (aclresult != ACLCHECK_OK)
+               aclcheck_error(aclresult, ACL_KIND_CLASS,
+                                          RelationGetRelationName(rel));
+
        if (rel->rd_rel->relkind == RELKIND_VIEW)
                return currtid_for_view(rel, tid);
 
@@ -354,9 +364,17 @@ currtid_byrelname(PG_FUNCTION_ARGS)
        ItemPointer result;
        RangeVar   *relrv;
        Relation        rel;
+       AclResult       aclresult;
 
        relrv = makeRangeVarFromNameList(textToQualifiedNameList(relname));
        rel = heap_openrv(relrv, AccessShareLock);
+
+       aclresult = pg_class_aclcheck(RelationGetRelid(rel), GetUserId(),
+                                                                 ACL_SELECT);
+       if (aclresult != ACLCHECK_OK)
+               aclcheck_error(aclresult, ACL_KIND_CLASS,
+                                          RelationGetRelationName(rel));
+
        if (rel->rd_rel->relkind == RELKIND_VIEW)
                return currtid_for_view(rel, tid);