check if newOwner != azpg.user before granting the role

movetokube · Aug 29, 2024 · 3a26caa · 3a26caa
1 parent 035c13a
commit 3a26caa
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/pkg/postgres/azure.go b/pkg/postgres/azure.go
@@ -72,6 +72,7 @@ func (azpg *azurepg) DropRole(role, newOwner, database string, logger logr.Logge
 			}
 			return err
 		}
+
 		err = azpg.pg.GrantRole(newOwner, azpg.user)
 		if err != nil && err.(*pq.Error).Code != "0LP01" {
 			if err.(*pq.Error).Code == "42704" {
@@ -81,6 +82,7 @@ func (azpg *azurepg) DropRole(role, newOwner, database string, logger logr.Logge
 			}
 			return err
 		}
+
 		defer azpg.pg.RevokeRole(newOwner, azpg.pg.user)
 
 		return azpg.pg.DropRole(role, newOwner, database, logger)

diff --git a/pkg/postgres/role.go b/pkg/postgres/role.go
@@ -37,6 +37,10 @@ func (c *pg) CreateUserRole(role, password string) (string, error) {
 }
 
 func (c *pg) GrantRole(role, grantee string) error {
+	// Don't grant role to itself
+	if grantee == role {
+		return nil
+	}
 	_, err := c.db.Exec(fmt.Sprintf(GRANT_ROLE, role, grantee))
 	if err != nil {
 		return err