github/repmgr
1
0
Fork 0
mirror of https://github.com/EnterpriseDB/repmgr.git synced 2026-03-22 22:56:29 +00:00
Code Issues Packages Projects Releases 1 Wiki Activity

Added check for ALTER SYSTEM permission presence

Browse Source
This commit is contained in:
RealGreenDragon
2023-05-07 15:43:11 +02:00
committed by Martín Marqués
parent d3b1ff45b0
commit e8aa3aced7
1 changed files with 40 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
dbutils.c
View File

@@ -1913,15 +1913,47 @@ can_disable_walsender(PGconn *conn)
if (is_superuser_connection(conn, NULL) == true)
return true;
/*
* As of PostgreSQL 14, it is not possible for a non-superuser
* to execute ALTER SYSTEM, so further checks are superfluous.
* This will need modifying for PostgreSQL 15.
*/
log_warning(_("\"standby_disconnect_on_failover\" specified, but repmgr user is not a superuser"));
log_detail(_("superuser permission required to disable standbys on failover"));
PQExpBufferData query;
PGresult *res;
bool has_alter_system_priv = false;
return false;
/* GRANT ALTER SYSTEM available from PostgreSQL 15 */
if (PQserverVersion(conn) >= 150000)
{
initPQExpBuffer(&query);
appendPQExpBufferStr(&query,
" SELECT pg_catalog.has_parameter_privilege('wal_retrieve_retry_interval', 'ALTER SYSTEM') ");
res = PQexec(conn, query.data);
if (PQresultStatus(res) != PGRES_TUPLES_OK)
{
log_db_error(conn, query.data,
_("can_disable_walsender(): unable to query user parameter privileges"));
}
else
{
has_alter_system_priv = atobool(PQgetvalue(res, 0, 0));
}
termPQExpBuffer(&query);
PQclear(res);
}
if (has_alter_system_priv == false)
{
log_warning(_("\"standby_disconnect_on_failover\" specified, but repmgr user is not authorized to ALTER SYSTEM"));
if (PQserverVersion(conn) >= 150000)
{
log_detail(_("superuser or ALTER SYSTEM wal_retrieve_retry_interval permission required to disable standbys on failover"));
}
else
{
log_detail(_("superuser permission required to disable standbys on failover"));
}
}
return has_alter_system_priv;
}
/*