@@ -1652,7 +1652,7 @@ CREATE RULE shoelace_ins AS ON INSERT TO shoelace
1652
1652
Now assume that once in a while, a pack of shoelaces arrives at
1653
1653
the shop and a big parts list along with it. But you don't want
1654
1654
to manually update the <literal>shoelace</literal> view every
1655
- time. Instead we setup two little tables: one where you can
1655
+ time. Instead we set up two little tables: one where you can
1656
1656
insert the items from the part list, and one with a special
1657
1657
trick. The creation commands for these are:
1658
1658
@@ -2023,57 +2023,57 @@ SELECT * FROM shoelace;
2023
2023
behavior of the default access control system. Relations that
2024
2024
are used due to rules get checked against the
2025
2025
privileges of the rule owner, not the user invoking the rule.
2026
- This means that a user only needs the required privileges
2027
- for the tables/views that he names explicitly in his queries.
2026
+ This means that users only need the required privileges
2027
+ for the tables/views that are explicitly named in their queries.
2028
2028
</para>
2029
2029
2030
2030
<para>
2031
2031
For example: A user has a list of phone numbers where some of
2032
- them are private, the others are of interest for the secretary of the office.
2033
- He can construct the following:
2032
+ them are private, the others are of interest for the assistant of the office.
2033
+ The user can construct the following:
2034
2034
2035
2035
<programlisting>
2036
2036
CREATE TABLE phone_data (person text, phone text, private boolean);
2037
2037
CREATE VIEW phone_number AS
2038
2038
SELECT person, CASE WHEN NOT private THEN phone END AS phone
2039
2039
FROM phone_data;
2040
- GRANT SELECT ON phone_number TO secretary ;
2040
+ GRANT SELECT ON phone_number TO assistant ;
2041
2041
</programlisting>
2042
2042
2043
- Nobody except him (and the database superusers) can access the
2043
+ Nobody except that user (and the database superusers) can access the
2044
2044
<literal>phone_data</> table. But because of the <command>GRANT</>,
2045
- the secretary can run a <command>SELECT</command> on the
2045
+ the assistant can run a <command>SELECT</command> on the
2046
2046
<literal>phone_number</> view. The rule system will rewrite the
2047
2047
<command>SELECT</command> from <literal>phone_number</> into a
2048
2048
<command>SELECT</command> from <literal>phone_data</>.
2049
2049
Since the user is the owner of
2050
2050
<literal>phone_number</> and therefore the owner of the rule, the
2051
- read access to <literal>phone_data</> is now checked against his
2051
+ read access to <literal>phone_data</> is now checked against the user's
2052
2052
privileges and the query is permitted. The check for accessing
2053
2053
<literal>phone_number</> is also performed, but this is done
2054
2054
against the invoking user, so nobody but the user and the
2055
- secretary can use it.
2055
+ assistant can use it.
2056
2056
</para>
2057
2057
2058
2058
<para>
2059
- The privileges are checked rule by rule. So the secretary is for now the
2060
- only one who can see the public phone numbers. But the secretary can setup
2059
+ The privileges are checked rule by rule. So the assistant is for now the
2060
+ only one who can see the public phone numbers. But the assistant can set up
2061
2061
another view and grant access to that to the public. Then, anyone
2062
- can see the <literal>phone_number</> data through the secretary 's view.
2063
- What the secretary cannot do is to create a view that directly
2064
- accesses <literal>phone_data</>. (Actually he can, but it will not work since
2062
+ can see the <literal>phone_number</> data through the assistant 's view.
2063
+ What the assistant cannot do is to create a view that directly
2064
+ accesses <literal>phone_data</>. (Actually the assistant can, but it will not work since
2065
2065
every access will be denied during the permission checks.)
2066
- And as soon as the user will notice, that the secretary opened
2067
- his <literal>phone_number</> view, he can revoke his access. Immediately, any
2068
- access to the secretary 's view would fail.
2066
+ And as soon as the user notices that the assistant opened
2067
+ their <literal>phone_number</> view, the user can revoke the assistant's access. Immediately, any
2068
+ access to the assistant 's view would fail.
2069
2069
</para>
2070
2070
2071
2071
<para>
2072
2072
One might think that this rule-by-rule checking is a security
2073
- hole, but in fact it isn't. But if it did not work this way, the secretary
2073
+ hole, but in fact it isn't. But if it did not work this way, the assistant
2074
2074
could set up a table with the same columns as <literal>phone_number</> and
2075
- copy the data to there once per day. Then it's his own data and
2076
- he can grant access to everyone he wants . A
2075
+ copy the data to there once per day. Then it's the assistant's own data and
2076
+ the assistant can grant access to everyone they want . A
2077
2077
<command>GRANT</command> command means, <quote>I trust you</quote>.
2078
2078
If someone you trust does the thing above, it's time to
2079
2079
think it over and then use <command>REVOKE</command>.
@@ -2093,7 +2093,7 @@ CREATE VIEW phone_number AS
2093
2093
<command>SELECT</command> from <literal>phone_number</> into a
2094
2094
<command>SELECT</command> from <literal>phone_data</> and add the
2095
2095
qualification that only entries where <literal>phone</> does not begin
2096
- with 412 are wanted. But if the user can create his or her own functions,
2096
+ with 412 are wanted. But if the user can create their own functions,
2097
2097
it is not difficult to convince the planner to execute the user-defined
2098
2098
function prior to the <function>NOT LIKE</function> expression.
2099
2099
For example:
@@ -2124,8 +2124,8 @@ SELECT * FROM phone_number WHERE tricky(person, phone);
2124
2124
the <literal>shoelace</> view to someone else, but only
2125
2125
<literal>SELECT</> on <literal>shoelace_log</>. The rule action to
2126
2126
write log entries will still be executed successfully, and that
2127
- other user could see the log entries. But he cannot create fake
2128
- entries, nor could he manipulate or remove existing ones. In this
2127
+ other user could see the log entries. But they could not create fake
2128
+ entries, nor could they manipulate or remove existing ones. In this
2129
2129
case, there is no possibility of subverting the rules by convincing
2130
2130
the planner to alter the order of operations, because the only rule
2131
2131
which references <literal>shoelace_log</> is an unqualified
@@ -2333,7 +2333,7 @@ DELETE FROM software WHERE computer.hostname = 'mypc.local.net'
2333
2333
AND software.hostname = computer.hostname;
2334
2334
</programlisting>
2335
2335
2336
- Since there are appropriate indexes setup , the planner
2336
+ Since there are appropriate indexes set up , the planner
2337
2337
will create a plan of
2338
2338
2339
2339
<literallayout class="monospaced">
0 commit comments