Merge branch '2.27.x' into release/2.27.1-changelog

Author: surister

.unreleased/pr_9795

@@ -0,0 +1 @@
+Fixes: #9795 Delete orphaned compression_settings before migrating catalog table

.unreleased/pr_9800

@@ -0,0 +1 @@
+Fixes: #9800 Check hypertable ownership before recompression

.unreleased/pr_9801

@@ -0,0 +1 @@
+Fixes: #9801 Fix information leak in policy_reorder_remove

sql/updates/2.18.2--2.19.0.sql

@@ -8,6 +8,16 @@ INSERT INTO _timescaledb_catalog.compression_algorithm( id, version, name, descr
 ( 6, 1, 'COMPRESSION_ALGORITHM_NULL', 'null')
 ;
 
+-- clean up orphaned compression settings
+DELETE FROM _timescaledb_catalog.compression_settings cs
+WHERE
+  NOT EXISTS (SELECT FROM _timescaledb_catalog.hypertable h WHERE format('%I.%I', h.schema_name, h.table_name)::regclass = cs.relid)
+  AND NOT EXISTS (
+    SELECT FROM _timescaledb_catalog.chunk cch
+    JOIN _timescaledb_catalog.chunk ch ON ch.compressed_chunk_id = cch.id
+    WHERE NOT ch.dropped AND NOT cch.dropped AND format('%I.%I', cch.schema_name, cch.table_name)::regclass = cs.relid
+);
+
 -------------------------------
 -- Update compression settings
 -------------------------------
@@ -95,4 +105,4 @@ CREATE FUNCTION @extschema@.add_continuous_aggregate_policy(
 )
 RETURNS INTEGER
 AS '@MODULE_PATHNAME@', 'ts_update_placeholder'
-LANGUAGE C VOLATILE;
+LANGUAGE C VOLATILE;

tsl/src/bgw_policy/reorder_api.c

@@ -310,11 +310,14 @@ policy_reorder_remove(PG_FUNCTION_ARGS)
 	TS_PREVENT_FUNC_IF_READ_ONLY();
 
 	ht = ts_hypertable_cache_get_cache_and_entry(hypertable_oid, CACHE_FLAG_NONE, &hcache);
+	int32 ht_id = ht->fd.id;
+	ts_cache_release(&hcache);
+
+	ts_hypertable_permissions_check(hypertable_oid, GetUserId());
 
 	List *jobs = ts_bgw_job_find_by_proc_and_hypertable_id(POLICY_REORDER_PROC_NAME,
 														   FUNCTIONS_SCHEMA_NAME,
-														   ht->fd.id);
-	ts_cache_release(&hcache);
+														   ht_id);
 
 	if (jobs == NIL)
 	{
@@ -336,8 +339,6 @@ policy_reorder_remove(PG_FUNCTION_ARGS)
 	Assert(list_length(jobs) == 1);
 	BgwJob *job = linitial(jobs);
 
-	ts_hypertable_permissions_check(hypertable_oid, GetUserId());
-
 	ts_bgw_job_delete_by_id(job->fd.id);
 
 	PG_RETURN_NULL();

tsl/src/compression/api.c

@@ -886,6 +886,7 @@ tsl_compress_chunk(PG_FUNCTION_ARGS)
 
 	TS_PREVENT_FUNC_IF_READ_ONLY();
 	Chunk *chunk = ts_chunk_get_by_relid(uncompressed_chunk_id, true);
+	ts_hypertable_permissions_check(chunk->hypertable_relid, GetUserId());
 
 	uncompressed_chunk_id = tsl_compress_chunk_wrapper(chunk, if_not_compressed, recompress);
 
@@ -1029,6 +1030,7 @@ tsl_rebuild_columnstore(PG_FUNCTION_ARGS)
 	}
 
 	Chunk *chunk = ts_chunk_get_by_relid(chunk_relid, true);
+	ts_hypertable_permissions_check(chunk->hypertable_relid, GetUserId());
 
 	if (!ts_chunk_is_compressed(chunk) || ts_chunk_is_frozen(chunk))
 	{

tsl/src/compression/recompress.c

@@ -6,6 +6,7 @@
 
 #include <postgres.h>
 #include "debug_point.h"
+#include <miscadmin.h>
 #include <parser/parse_coerce.h>
 #include <parser/parse_relation.h>
 #include <utils/inval.h>
@@ -22,6 +23,7 @@
 #include "create.h"
 #include "debug_assert.h"
 #include "guc.h"
+#include "hypertable.h"
 #include "indexing.h"
 #include "recompress.h"
 #include "ts_catalog/array_utils.h"
@@ -82,6 +84,7 @@ tsl_recompress_chunk_segmentwise(PG_FUNCTION_ARGS)
 	ts_feature_flag_check(FEATURE_HYPERTABLE_COMPRESSION);
 	TS_PREVENT_FUNC_IF_READ_ONLY();
 	Chunk *chunk = ts_chunk_get_by_relid(uncompressed_chunk_id, true);
+	ts_hypertable_permissions_check(chunk->hypertable_relid, GetUserId());
 
 	if (!ts_chunk_is_partial(chunk))
 	{

tsl/test/expected/compression_permissions-15.out

@@ -59,8 +59,15 @@ ERROR:  must be owner of table conditions
 \c :TEST_DBNAME :ROLE_DEFAULT_PERM_USER_2
 SELECT compress_chunk(show_chunks('conditions'));
 ERROR:  must be owner of hypertable "conditions"
+SELECT compress_chunk(show_chunks('conditions'), recompress => true);
+ERROR:  must be owner of hypertable "conditions"
 SELECT decompress_chunk(show_chunks('conditions'));
 ERROR:  must be owner of hypertable "conditions"
+SELECT show_chunks('conditions') AS chunk LIMIT 1 \gset
+CALL _timescaledb_functions.rebuild_columnstore(:'chunk'::regclass);
+ERROR:  must be owner of hypertable "conditions"
+SELECT _timescaledb_functions.recompress_chunk_segmentwise(show_chunks('conditions'));
+ERROR:  must be owner of hypertable "conditions"
 select add_compression_policy('conditions', '1day'::interval);
 ERROR:  must be owner of hypertable "conditions"
 \c :TEST_DBNAME :ROLE_DEFAULT_PERM_USER

tsl/test/expected/compression_permissions-16.out

@@ -59,8 +59,15 @@ ERROR:  must be owner of table conditions
 \c :TEST_DBNAME :ROLE_DEFAULT_PERM_USER_2
 SELECT compress_chunk(show_chunks('conditions'));
 ERROR:  must be owner of hypertable "conditions"
+SELECT compress_chunk(show_chunks('conditions'), recompress => true);
+ERROR:  must be owner of hypertable "conditions"
 SELECT decompress_chunk(show_chunks('conditions'));
 ERROR:  must be owner of hypertable "conditions"
+SELECT show_chunks('conditions') AS chunk LIMIT 1 \gset
+CALL _timescaledb_functions.rebuild_columnstore(:'chunk'::regclass);
+ERROR:  must be owner of hypertable "conditions"
+SELECT _timescaledb_functions.recompress_chunk_segmentwise(show_chunks('conditions'));
+ERROR:  must be owner of hypertable "conditions"
 select add_compression_policy('conditions', '1day'::interval);
 ERROR:  must be owner of hypertable "conditions"
 \c :TEST_DBNAME :ROLE_DEFAULT_PERM_USER

tsl/test/expected/compression_permissions-17.out

@@ -59,8 +59,15 @@ ERROR:  must be owner of table conditions
 \c :TEST_DBNAME :ROLE_DEFAULT_PERM_USER_2
 SELECT compress_chunk(show_chunks('conditions'));
 ERROR:  must be owner of hypertable "conditions"
+SELECT compress_chunk(show_chunks('conditions'), recompress => true);
+ERROR:  must be owner of hypertable "conditions"
 SELECT decompress_chunk(show_chunks('conditions'));
 ERROR:  must be owner of hypertable "conditions"
+SELECT show_chunks('conditions') AS chunk LIMIT 1 \gset
+CALL _timescaledb_functions.rebuild_columnstore(:'chunk'::regclass);
+ERROR:  must be owner of hypertable "conditions"
+SELECT _timescaledb_functions.recompress_chunk_segmentwise(show_chunks('conditions'));
+ERROR:  must be owner of hypertable "conditions"
 select add_compression_policy('conditions', '1day'::interval);
 ERROR:  must be owner of hypertable "conditions"
 \c :TEST_DBNAME :ROLE_DEFAULT_PERM_USER