Hi, While testing another patch, I found a bug related to subscriptions created using a foreign server.
Suppose a subscription is created using a foreign server, and the subscription owner does not have permission to access that server. If the owner executes ALTER SUBSCRIPTION ... REFRESH PUBLICATION, ADD PUBLICATION, DROP PUBLICATION, or SET PUBLICATION, the command can still connect to the publisher and fetch the updated relation list. This happens because AlterSubscription() calls: GetSubscription(subid, false, orig_conninfo_needed, false) with conninfo_aclcheck set to false, so the ACL check on the associated foreign server is skipped. The attached patch fixes this by enabling conninfo_aclcheck for these ALTER SUBSCRIPTION operations, ensuring that permissions on the foreign server are validated before connecting to the publisher. Thoughts? I am posting the patch in this thread since the related changes were made here. Thanks, Shlok Kyal
v1-0001-Check-foreign-server-permissions-for-ALTER-SUBSCR.patch
Description: Binary data
