citusdata / citusdata/pg_cron

API inconsistency: `cron.unschedule(jobid)` can unschedule jobs of another user but `cron.unschedule(jobname)` cannot

Open
#320 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
3.9k
Forks
260
Avg merge
5d 5h
Merged PRs (30d)
1

Description

The API function `cron.unschedule` has two overloaded versions - one takes a `jobid`, the other takes a `jobname`.

The one taking `jobid` unschedules the job without looking at the current user column. As a result, one user can unschedule jobs created by another user so long as row level security rules allow for record visibility.

But, the version of `cron.unschedule` function that takes a job name behaves differently.
It filters for jobs started by current user ([source](https://github.com/citusdata/pg_cron/blob/7e91e72b1bebc5869bb900d9253cc9e92518b33f/src/job_metadata.c#L719-L720)) and reports that task was not found if the task with the passed name was started by another user.

```SQL
SET ROLE some_non_superuser;

SELECT cron.schedule('some_name', '1 second', $$SELECT 1$$) as some_name_jobid \gset

SET ROLE some_superuser;

\set ON_ERROR_STOP off
SELECT cron.unschedule('some_name'); --fails
\set ON_ERROR_STOP on

SELECT cron.unschedule(:some_name_jobid); --succeeds
```

The fix probably is to delete the mentioned lines above, or add them in [`cron_schedule`](https://github.com/citusdata/pg_cron/blob/7e91e72b1bebc5869bb900d9253cc9e92518b33f/src/job_metadata.c#L649), depending on intended API.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.