Re: Using views for row-level access control is leaky

Pavel Stehule wrote:
>
> postgres=# create or replace function vv(int, int) returns bool as
> $$begin raise notice '% %', $1, $2; return true; end$$ language
> plpgsql COST 0.000001;
> CREATE FUNCTION
> postgres=# select * from v where vv(a,b);NOTICE:  10 20
>  a │ b
> ───┼───
> (0 rows)
>
> still I have not bad result, but, yes, I see what I could not to see.

Ah - that's the problem. It's not possible to get the "hidden" values
into the result set, but it is possible to see them. It only matters if
you are using the view to prevent access to certain rows.

--  Richard Huxton Archonet Ltd