Make CREATE CONSTRAINT TRIGGER check for REFERENCES privilege on both

master and slave tables.

diff --git a/src/backend/commands/trigger.c b/src/backend/commands/trigger.c
index d386fe5665f1ed523f0924b72c4f9866c1bf64a0..312bad43525a02fa5881db18655e965561bfad3d 100644 (file)
--- a/src/backend/commands/trigger.c
+++ b/src/backend/commands/trigger.c
@@ -7,7 +7,7 @@
  * Portions Copyright (c) 1994, Regents of the University of California
  *
  * IDENTIFICATION
- *   $Header: /cvsroot/pgsql/src/backend/commands/trigger.c,v 1.126 2002/08/17 12:15:48 momjian Exp $
+ *   $Header: /cvsroot/pgsql/src/backend/commands/trigger.c,v 1.127 2002/08/18 11:20:05 petere Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -86,6 +86,11 @@ CreateTrigger(CreateTrigStmt *stmt, bool forConstraint)
 
    rel = heap_openrv(stmt->relation, AccessExclusiveLock);
 
+   if (stmt->constrrel != NULL)
+       constrrelid = RangeVarGetRelid(stmt->constrrel, false);
+   else
+       constrrelid = InvalidOid;
+
    if (rel->rd_rel->relkind != RELKIND_RELATION)
        elog(ERROR, "CreateTrigger: relation \"%s\" is not a table",
             stmt->relation->relname);
@@ -94,10 +99,29 @@ CreateTrigger(CreateTrigStmt *stmt, bool forConstraint)
        elog(ERROR, "CreateTrigger: can't create trigger for system relation %s",
            stmt->relation->relname);
 
-   aclresult = pg_class_aclcheck(RelationGetRelid(rel), GetUserId(),
-                         stmt->isconstraint ? ACL_REFERENCES : ACL_TRIGGER);
-   if (aclresult != ACLCHECK_OK)
-       aclcheck_error(aclresult, RelationGetRelationName(rel));
+   /* permission checks */
+
+   if (stmt->isconstraint)
+   {
+       /* foreign key constraint trigger */
+
+       aclresult = pg_class_aclcheck(RelationGetRelid(rel), GetUserId(), ACL_REFERENCES);
+       if (aclresult != ACLCHECK_OK)
+           aclcheck_error(aclresult, RelationGetRelationName(rel));
+       if (constrrelid != InvalidOid)
+       {
+           aclresult = pg_class_aclcheck(constrrelid, GetUserId(), ACL_REFERENCES);
+           if (aclresult != ACLCHECK_OK)
+               aclcheck_error(aclresult, get_rel_name(constrrelid));
+       }
+   }
+   else
+   {
+       /* real trigger */
+       aclresult = pg_class_aclcheck(RelationGetRelid(rel), GetUserId(), ACL_TRIGGER);
+       if (aclresult != ACLCHECK_OK)
+           aclcheck_error(aclresult, RelationGetRelationName(rel));
+   }
 
    /*
     * Generate the trigger's OID now, so that we can use it in the name
@@ -124,11 +148,6 @@ CreateTrigger(CreateTrigStmt *stmt, bool forConstraint)
        constrname = "";
    }
 
-   if (stmt->constrrel != NULL)
-       constrrelid = RangeVarGetRelid(stmt->constrrel, false);
-   else
-       constrrelid = InvalidOid;
-
    TRIGGER_CLEAR_TYPE(tgtype);
    if (stmt->before)
        TRIGGER_SETT_BEFORE(tgtype);