Skip to content

Commit e67aa95

Browse files
committed
Fix job_errors view leaking failed jobs to non-owners
A missing pair of parentheses made operator precedence apply the role check only to crash rows. Failed jobs bypassed the check, so any user could see error details from other users' jobs.
1 parent 903aaf0 commit e67aa95

3 files changed

Lines changed: 5 additions & 11 deletions

File tree

.unreleased/pr_9799

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Fixes: #9799 Fix job_errors view leaking failed jobs to non-owners

sql/views.sql

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -323,8 +323,7 @@ FROM
323323
LEFT JOIN
324324
_timescaledb_catalog.bgw_job j ON (j.id = h.job_id)
325325
WHERE
326-
h.succeeded IS FALSE
327-
OR h.succeeded IS NULL
326+
(h.succeeded IS FALSE OR h.succeeded IS NULL)
328327
AND (pg_catalog.pg_has_role(current_user,
329328
(SELECT pg_catalog.pg_get_userbyid(datdba)
330329
FROM pg_catalog.pg_database

tsl/test/expected/bgw_job_stat_history_errors_permissions.out

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -82,23 +82,17 @@ SET ROLE :ROLE_DEFAULT_PERM_USER;
8282
SELECT job_id, proc_schema, proc_name, sqlerrcode, err_message
8383
FROM timescaledb_information.job_errors WHERE job_id >= 1000
8484
ORDER BY job_id;
85-
job_id | proc_schema | proc_name | sqlerrcode | err_message
86-
--------+-------------+--------------+------------+-----------------------------------------------------
87-
1000 | public | job_fail | P0001 | raising an exception
88-
1002 | public | custom_proc2 | 40001 | could not serialize access due to concurrent update
89-
11111 | | | | not an error
90-
22222 | | | |
85+
job_id | proc_schema | proc_name | sqlerrcode | err_message
86+
--------+-------------+-----------+------------+----------------------
87+
1000 | public | job_fail | P0001 | raising an exception
9188

9289
SET ROLE :ROLE_DEFAULT_PERM_USER_2;
9390
SELECT job_id, proc_schema, proc_name, sqlerrcode, err_message
9491
FROM timescaledb_information.job_errors WHERE job_id >= 1000
9592
ORDER BY job_id;
9693
job_id | proc_schema | proc_name | sqlerrcode | err_message
9794
--------+-------------+--------------+------------+-----------------------------------------------------
98-
1000 | public | job_fail | P0001 | raising an exception
9995
1002 | public | custom_proc2 | 40001 | could not serialize access due to concurrent update
100-
11111 | | | | not an error
101-
22222 | | | |
10296

10397
SET ROLE :ROLE_SUPERUSER;
10498
SELECT job_id, proc_schema, proc_name, sqlerrcode, err_message

0 commit comments

Comments
 (0)