fix: don't allow alter role nosuperuser

supabase · May 31, 2024 · 6d2c6e0 · 6d2c6e0
1 parent 40daf95
commit 6d2c6e0
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/src/supautils.c b/src/supautils.c
@@ -333,7 +333,7 @@ supautils_hook(PROCESS_UTILITY_PARAMS)
 				foreach(option_cell, stmt->options)
 				{
 					DefElem *defel = (DefElem *) lfirst(option_cell);
-					if (strcmp(defel->defname, "superuser") == 0 && defGetBoolean(defel)) {
+					if (strcmp(defel->defname, "superuser") == 0) {
 						ereport(ERROR,
 								(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
 								 errmsg("permission denied to alter role"),

diff --git a/test/expected/privileged_role.out b/test/expected/privileged_role.out
@@ -187,6 +187,8 @@ ERROR:  permission denied to create role
 DETAIL:  Only roles with the SUPERUSER attribute may create roles with the SUPERUSER attribute.
 create role r;
 alter role r nosuperuser;
+ERROR:  permission denied to alter role
+DETAIL:  Only roles with the SUPERUSER attribute may alter roles with the SUPERUSER attribute.
 alter role r superuser;
 ERROR:  permission denied to alter role
 DETAIL:  Only roles with the SUPERUSER attribute may alter roles with the SUPERUSER attribute.