Skip to content

Commit 0e0ea5a

Browse files
committed
further improvements
1 parent cf3a24f commit 0e0ea5a

File tree

8 files changed

+35
-67
lines changed

8 files changed

+35
-67
lines changed

modules/ROOT/pages/authentication-authorization/dbms-administration.adoc

Lines changed: 24 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1233,7 +1233,7 @@ a|Rows: 1
12331233
|===
12341234

12351235
[rol=label--new-2025.06]
1236-
=== Grant privilege to modify a composite databases
1236+
=== Grant privilege to modify composite databases
12371237

12381238
You can grant the privilege to modify composite databases using the `ALTER COMPOSITE DATABASE` privilege. +
12391239
For example:
@@ -1857,7 +1857,7 @@ Both `EXECUTE PROCEDURE` and `EXECUTE BOOSTED PROCEDURE` are needed to execute a
18571857

18581858
You can grant the privilege to execute some procedures with elevated privileges using `EXECUTE BOOSTED PROCEDURE *`.
18591859

1860-
For example, the following query allow the execution of all procedures and `db.labels` and `db.relationshipTypes` with elevated privileges:
1860+
For example, the following query allow the execution of all procedures and `db.labels` and `db.relationshipTypes` with elevated privileges, and all other procedures with the user's own privileges:
18611861

18621862
[source, cypher, role=noplay]
18631863
----
@@ -1868,7 +1868,6 @@ GRANT EXECUTE BOOSTED PROCEDURE db.labels, db.relationshipTypes ON DBMS TO boost
18681868
Users with the role `boostedProcedureExecutor` can thus run the `db.labels` and the `db.relationshipTypes` procedures with full privileges, seeing everything in the graph and not just the labels and types that the user has `TRAVERSE` privilege on.
18691869
Without the `EXECUTE PROCEDURE`, no procedures could be executed at all.
18701870

1871-
As a result, the `boostedProcedureExecutor` role has privileges that allow executing the procedures `db.labels` and `db.relationshipTypes` with elevated privileges, and all other procedures with the user's own privileges.
18721871
To list all privileges for the role `boostedProcedureExecutor` as commands, use the following query:
18731872

18741873
[source, cypher, role=noplay]
@@ -1886,21 +1885,22 @@ SHOW ROLE boostedProcedureExecutor PRIVILEGES AS COMMANDS;
18861885
a|Rows: 3
18871886
|===
18881887

1889-
[[deny-privilege-to-execute-procedures-with-elevated-privileges]]
1890-
==== Deny privilege to execute procedures with elevated privileges
1888+
[[grant-execute-procedure-deny-elevation]]
1889+
==== Combination of granting execution and denying privilege elevation
18911890

1892-
As with grant, denying `EXECUTE BOOSTED PROCEDURE` on its own only affects the elevation and not the execution of the procedure. +
1893-
For example, the following query allows the execution of all procedures using the user's own privileges, but prevents the elevation of `db.labels`:
1891+
As with grant, denying `EXECUTE BOOSTED PROCEDURE` on its own only affects the elevation and not the execution of the procedure.
1892+
1893+
For example:
18941894

18951895
[source, cypher, role=noplay]
18961896
----
18971897
GRANT EXECUTE PROCEDURE * ON DBMS TO deniedBoostedProcedureExecutor1;
18981898
DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor1;
18991899
----
19001900

1901-
As a result, the `deniedBoostedProcedureExecutor1` role has privileges that allow the execution of all procedures using the user's own privileges.
1902-
It also prevents the `db.labels` procedure from being elevated.
1903-
Still, the denied `EXECUTE BOOSTED PROCEDURE` does not block the execution of `db.labels`.
1901+
As a result, the `deniedBoostedProcedureExecutor1` role has privileges that allow the execution of all procedures using the users own privileges.
1902+
They also prevent the `db.labels` procedure from being elevated.
1903+
Still, the denied `EXECUTE BOOSTED PROCEDURE` does not block execution of `db.labels`.
19041904

19051905
To list all privileges for role `deniedBoostedProcedureExecutor1` as commands, use the following query:
19061906

@@ -1918,12 +1918,12 @@ SHOW ROLE deniedBoostedProcedureExecutor1 PRIVILEGES AS COMMANDS;
19181918
a|Rows: 2
19191919
|===
19201920

1921-
[[execute-boosted-procedures-deny-execution]]
1922-
==== Grant privilege to execute boosted procedures and deny execution of specific procedures
1921+
[[grant-privilege-elevation-deny-execution]]
1922+
==== Combination of granting privilege elevation and denying execution
19231923

1924-
You can also grant the privilege to execute boosted procedures and deny the execution of specific procedures.
1924+
You can also grant the privilege to execute procedures with elevated privileges and deny the execution of specific procedures.
19251925

1926-
For example, the following queries allow the execution of all boosted procedures, except `db.labels`:
1926+
For example:
19271927

19281928
[source, cypher, role=noplay]
19291929
----
@@ -1936,6 +1936,7 @@ DENY EXECUTE PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecutor2;
19361936
----
19371937

19381938
As a result, the `deniedBoostedProcedureExecutor2` role has privileges that allow elevating the privileges for all procedures, but cannot execute any due to missing or denied `EXECUTE PROCEDURE` privileges.
1939+
19391940
To list all privileges for the role `deniedBoostedProcedureExecutor2` as commands, use the following query:
19401941

19411942
[source, cypher, role=noplay]
@@ -1952,12 +1953,13 @@ SHOW ROLE deniedBoostedProcedureExecutor2 PRIVILEGES AS COMMANDS;
19521953
a|Rows: 2
19531954
|===
19541955

1955-
[[execute-boosted-procedures-deny-elevation]]
1956-
==== Grant privilege to execute boosted procedures and deny elevation of specific procedures
1956+
[[grant-deny-privilege-elevation]]
1957+
==== Combination of granting and denying privilege elevation
19571958

1958-
You can also grant the privilege to execute boosted procedures and deny the elevation of specific procedures.
1959+
You can also grant the privilege to execute procedures with elevated privileges and deny the elevation for specific procedures.
19591960

1960-
For example, the following queries allow the execution of all boosted procedures, except `db.labels`:
1961+
For example, the following queries allow has privileges that allow elevating the privileges for all procedures except `db.labels`.
1962+
However, no procedures can be executed due to a missing `EXECUTE BOOSTED PROCEDURE` privilege.
19611963

19621964
[source, cypher, role=noplay]
19631965
----
@@ -1971,6 +1973,7 @@ DENY EXECUTE BOOSTED PROCEDURE db.labels ON DBMS TO deniedBoostedProcedureExecut
19711973

19721974
As a result, the `deniedBoostedProcedureExecutor3` role has privileges that allow elevating the privileges for all procedures except `db.labels`.
19731975
However, no procedures can be executed due to missing `EXECUTE PROCEDURE` privilege.
1976+
19741977
To list all privileges for the role `deniedBoostedProcedureExecutor3` as commands, use the following query:
19751978

19761979
[source, cypher, role=noplay]
@@ -1994,7 +1997,7 @@ For example, assume there is a procedure called `myProc`.
19941997

19951998
This procedure gives the result `A` and `B` for a user with `EXECUTE PROCEDURE` privilege and `A`, `B` and `C` for a user with `EXECUTE BOOSTED PROCEDURE` privilege.
19961999

1997-
Now, adapt the privileges from sections <<deny-privilege-to-execute-procedures-with-elevated-privileges, Deny privilege to execute procedures with elevated privileges>> (example 1), <<execute-boosted-procedures-deny-execution, Grant privilege to execute boosted procedures and deny execution of specific procedures>> (example 2), and <<execute-boosted-procedures-deny-elevation, Grant privilege to execute boosted procedures and deny elevation of specific procedures>> (example 3) to be applied to this procedure and show what is returned.
2000+
Now, adapt the privileges from sections <<grant-execute-procedure-deny-elevation, Combination of granting execution and denying privilege elevation>> (example 1), <<grant-privilege-elevation-deny-execution, Combination of granting privilege elevation and denying execution>> (example 2), and <<grant-deny-privilege-elevation, Combination of granting and denying privilege elevations>> (example 3) to be applied to this procedure and show what is returned.
19982001

19992002
With the privileges from example 1, granted `EXECUTE PROCEDURE *` and denied `EXECUTE BOOSTED PROCEDURE myProc`, the `myProc` procedure returns the result `A` and `B`.
20002003

@@ -2094,7 +2097,6 @@ SHOW ROLE functionExecutor PRIVILEGES AS COMMANDS;
20942097
|"GRANT EXECUTE FUNCTION apoc.coll.* ON DBMS TO `functionExecutor`"
20952098
a|Rows: 1
20962099
|===
2097-
======
20982100

20992101
==== Grant privilege to execute execute all but some UDFs
21002102

@@ -2142,7 +2144,6 @@ a|Rows: 2
21422144
|===
21432145

21442146
The `apoc.any.property` and `apoc.any.properties` are blocked, as well as any other UDFs starting with `apoc.any.prop`.
2145-
======
21462147

21472148
[[access-control-execute-boosted-user-defined-function]]
21482149
=== Grant privilege to execute user-defined functions with elevated privileges
@@ -2224,7 +2225,7 @@ GRANT [IMMUTABLE] SHOW SETTING[S] name-globbing[, ...]
22242225

22252226
=== Grant privilege to show all settings
22262227

2227-
You can grant the privilege to show all settings using `SHOW SETTING *` or all settings in a namespace using `SHOW SETTING namespace.*`.
2228+
You can grant the privilege to show all settings using `SHOW SETTING \*` or all settings in a namespace using `SHOW SETTING namespace.*`.
22282229
The following query shows an example of how to grant `SHOW SETTING` privilege to view all settings in the `server.bolt` namespace:
22292230

22302231
[source, cypher, role=noplay]
@@ -2250,7 +2251,7 @@ SHOW ROLE configurationViewer PRIVILEGES AS COMMANDS;
22502251
a|Rows: 1
22512252
|===
22522253

2253-
=== Grant privilege to show execute all but some settings
2254+
=== Grant privilege to show all but some settings
22542255

22552256
You can grant the privilege to show all but a few settings using `SHOW SETTINGS *` and deny the unwanted settings. +
22562257
For example, the following queries allow you to view all settings, except those starting with `dbms.security`:

modules/ROOT/pages/backup-restore/copy-database.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,7 @@ If you go from `high_limit` to `standard` or `aligned`, there is no validation t
206206
[role=label--enterprise-edition]
207207
[NOTE]
208208
====
209-
The block format is the default format for all newly-created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified.
209+
The block format is the default format for all newly created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified.
210210
For more information on the block format, see xref:database-internals/store-formats.adoc[Store formats].
211211
====
212212

modules/ROOT/pages/configuration/cypher-version-configuration.adoc

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,16 @@
33
:page-role: new-2025.06
44
:description: How to configure the Cypher default version.
55

6-
You can specify the version of Cypher in which you want to run your queries, choosing between Cypher 5 and Cypher 25.
7-
Cypher 5 is the default version for all newly-created databases, however, if you want to take advantage of the new features in Cypher 25, you can set the default version to Cypher 25.
8-
9-
For more information about the Cypher versioning, see link:{neo4j-docs-base-uri}/cypher-manual/25/queries/select-version/[Cypher Manual -> Select Cypher version].
6+
You can specify the version of Cypher® in which you want to run your queries, choosing between Cypher 5 and Cypher 25.
7+
Cypher 5 is the default version for all newly created databases, however, if you want to take advantage of the new features in Cypher 25, you can set the default version to Cypher 25.
8+
For more information, see xref:introduction.adoc#_cypher_versions[Cypher® versions].
109

1110
To specify the Cypher version, use one of the following options:
1211

1312
Configure a default Cypher version for the whole DBMS::
1413
The default language version for the whole DBMS can be configured in the _neo4j.conf_ file using the setting xref:configuration/configuration-settings.adoc#config_db.query.default_language[db.query.default_language] (default value: CYPHER_5). +
15-
Changing this setting in an existing DBMS, *does not* affect existing databases.
16-
It only applies to newly-created databases unless the version is specified as part of the `CREATE` or `ALTER` database commands.
14+
Changing this setting in an existing DBMS *does not* affect existing databases.
15+
It only applies to newly created databases unless the version is specified as part of the `CREATE` or `ALTER` database commands.
1716

1817
Configure a default Cypher version per database::
1918
The default language for a specific database can be set using a Cypher database administration command with the `SET DEFAULT LANGUAGE` clause when creating the database or by altering the database after it has been created.

modules/ROOT/pages/database-administration/aliases/manage-aliases-composite-databases.adoc

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
= Managing database aliases in composite databases
55

66
Both local and remote database aliases can be created as part of a composite database.
7-
Starting with Neo4j 2025.04, a database alias can also be set as the default database for a composite database.
87

98
////
109
[source, cypher, role=test-setup]

modules/ROOT/pages/database-administration/aliases/manage-aliases-standard-databases.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ The driver options for connection to the remote database or `null` if the target
124124
List of xref::database-administration/aliases/manage-aliases-standard-databases.adoc#alias-management-create-remote-database-alias-driver-settings[driver settings] allowed for remote database aliases.
125125
| MAP
126126

127-
| defaultLanguage
127+
| defaultLanguage label:new[Introduced in 2025.06]
128128
|
129129
The default language for non-constituent remote database aliases or `null` if it is a constituent or local database alias.
130130
| STRING

modules/ROOT/pages/database-administration/standard-databases/alter-databases.adoc

Lines changed: 2 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -6,37 +6,6 @@ You can modify standard databases using the Cypher command `ALTER DATABASE`.
66

77
== Syntax
88

9-
[.tabbed-example]
10-
=====
11-
[role=include-with-cypher-5 label--before-2025.06]
12-
======
13-
[options="header", width="100%", cols="1m,5a"]
14-
|===
15-
| Command | Syntax
16-
17-
| ALTER DATABASE
18-
|
19-
[source, syntax, role="noheader"]
20-
----
21-
ALTER DATABASE name [IF EXISTS]
22-
{
23-
SET ACCESS {READ ONLY \| READ WRITE} \|
24-
SET TOPOLOGY n PRIMAR{Y\|IES} [m SECONDAR{Y\|IES}] \|
25-
SET OPTION option value
26-
}
27-
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
28-
----
29-
30-
[source, syntax]
31-
----
32-
ALTER DATABASE name [IF EXISTS]
33-
REMOVE OPTION option
34-
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
35-
----
36-
|===
37-
======
38-
[role=include-with-cypher-25 label--new-2025.06]
39-
======
409
[options="header", width="100%", cols="1m,5a"]
4110
|===
4211
| Command | Syntax
@@ -62,12 +31,12 @@ REMOVE OPTION option
6231
[WAIT [n [SEC[OND[S]]]]\|NOWAIT]
6332
----
6433
|===
65-
======
66-
=====
6734

6835
[NOTE]
6936
====
7037
There can be multiple `SET OPTION` or `REMOVE OPTION` clauses for different option keys.
38+
39+
`SET DEFAULT LANGUAGE CYPHER {5|25}` is available from Neo4j 2025.06 onwards.
7140
====
7241

7342
[role=label--enterprise-edition label--not-on-aura]

modules/ROOT/pages/database-administration/standard-databases/create-databases.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ Having dots (`.`) in the database names is not recommended.
2121
This is due to the difficulty of determining if a dot is part of the database name or a delimiter for a database alias in a composite database.
2222
====
2323

24-
`block` is the default format for all newly-created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified. +
24+
`block` is the default format for all newly created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified. +
2525
If you want to change it, you can set a new value for the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] configuration in the _neo4j.conf_ file. +
2626
Alternatively, you can set the store format of new databases using the `CREATE DATABASE databasename OPTIONS {storeFormat: 'the-new-format'}` command.
2727
However, if the store is seeded with `seedURI`, `existingDataSeedServer` or `existingDataSeedInstance`, or if the command is being used to mount pre-existing store files already present on the disk, they will use their current store format without any alterations.

modules/ROOT/pages/database-internals/store-formats.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ You can either set the store format when creating a new database or change the s
9292
[[create-new-databases]]
9393
=== Creating new databases
9494

95-
`block` is the default format for all newly-created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified. +
95+
`block` is the default format for all newly created databases as long as they do not have the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] setting specified. +
9696
If you want to change it, you can set a new value for the xref:configuration/configuration-settings.adoc#config_db.format[`db.format`] configuration in the _neo4j.conf_ file. +
9797
You can also create a new database on a specific store format by passing the new format as an argument to the command creating the database, for example, xref:import.adoc#import-tool-full[`neo4j-admin database import full`] or xref:backup-restore/copy-database.adoc[`neo4j-admin database copy`] commands, or by using `storeFormat:` option in the Cypher command `CREATE DATABASE`.
9898

0 commit comments

Comments
 (0)