API inconsistency: `cron.unschedule(jobid)` can unschedule jobs of another user but `cron.unschedule(jobname)` cannot
- Dominant language
- C
- Stars
- 3.9k
- Forks
- 260
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 1
Description
The API function `cron.unschedule` has two overloaded versions - one takes a `jobid`, the other takes a `jobname`.
The one taking `jobid` unschedules the job without looking at the current user column. As a result, one user can unschedule jobs created by another user so long as row level security rules allow for record visibility.
But, the version of `cron.unschedule` function that takes a job name behaves differently.
It filters for jobs started by current user ([source](https://github.com/citusdata/pg_cron/blob/7e91e72b1bebc5869bb900d9253cc9e92518b33f/src/job_metadata.c#L719-L720)) and reports that task was not found if the task with the passed name was started by another user.
```SQL
SET ROLE some_non_superuser;
SELECT cron.schedule('some_name', '1 second', $$SELECT 1$$) as some_name_jobid \gset
SET ROLE some_superuser;
\set ON_ERROR_STOP off
SELECT cron.unschedule('some_name'); --fails
\set ON_ERROR_STOP on
SELECT cron.unschedule(:some_name_jobid); --succeeds
```
The fix probably is to delete the mentioned lines above, or add them in [`cron_schedule`](https://github.com/citusdata/pg_cron/blob/7e91e72b1bebc5869bb900d9253cc9e92518b33f/src/job_metadata.c#L649), depending on intended API.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.