diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2020-11-03 15:41:32 -0500 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2020-11-03 15:41:32 -0500 |
| commit | d907bd0543aa63e59653d7345840bed0f8b3a83b (patch) | |
| tree | cc7718e4d1618c49087a7fccddd9ffa958e4933c /doc/src/sgml/ref/alter_role.sgml | |
| parent | bf797a8d9768239f5e3204b013044274b2c7c24a (diff) | |
| download | postgresql-d907bd0543aa63e59653d7345840bed0f8b3a83b.tar.gz | |
Allow users with BYPASSRLS to alter their own passwords.
The intention in commit 491c029db was to require superuserness to
change the BYPASSRLS property, but the actual effect of the coding
in AlterRole() was to require superuserness to change anything at all
about a BYPASSRLS role. Other properties of a BYPASSRLS role should
be changeable under the same rules as for a normal role, though.
Fix that, and also take care of some documentation omissions related
to BYPASSRLS and REPLICATION role properties.
Tom Lane and Stephen Frost, per bug report from Wolfgang Walther.
Back-patch to all supported branches.
Discussion: https://postgr.es/m/a5548a9f-89ee-3167-129d-162b5985fcf8@technowledgy.de
Diffstat (limited to 'doc/src/sgml/ref/alter_role.sgml')
| -rw-r--r-- | doc/src/sgml/ref/alter_role.sgml | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/doc/src/sgml/ref/alter_role.sgml b/doc/src/sgml/ref/alter_role.sgml index aef30521bc..5aa5648ae7 100644 --- a/doc/src/sgml/ref/alter_role.sgml +++ b/doc/src/sgml/ref/alter_role.sgml @@ -71,7 +71,9 @@ ALTER ROLE { <replaceable class="parameter">role_specification</replaceable> | A Attributes not mentioned in the command retain their previous settings. Database superusers can change any of these settings for any role. Roles having <literal>CREATEROLE</literal> privilege can change any of these - settings, but only for non-superuser and non-replication roles. + settings except <literal>SUPERUSER</literal>, <literal>REPLICATION</literal>, + and <literal>BYPASSRLS</literal>; but only for non-superuser and + non-replication roles. Ordinary roles can only change their own password. </para> |