From 53a9af8f1da46f30b31c52ad14369ccee1718ede Mon Sep 17 00:00:00 2001
From: "timour@mysql.com" <>
Date: Thu, 16 Dec 2004 18:04:51 +0200
Subject: [PATCH 1/7] Test for BUG#6054. The bug itsel is fixed by the fix for
 #5837.

---
 mysql-test/r/update.result | 6 ++++++
 mysql-test/t/update.test   | 9 +++++++++
 2 files changed, 15 insertions(+)

diff --git a/mysql-test/r/update.result b/mysql-test/r/update.result
index c9405d71237..08b7f942ccc 100644
--- a/mysql-test/r/update.result
+++ b/mysql-test/r/update.result
@@ -203,3 +203,9 @@ colC	colA	colD	colE	colF
 3	4433	10005	492	500
 DROP TABLE t1;
 DROP TABLE t2;
+drop table if exists t1, t2;
+create table t1 (c1 int, c2 char(6), c3 int);
+create table t2 (c1 int, c2 char(6));
+insert into t1 values (1, "t1c2-1", 10), (2, "t1c2-2", 20);
+update t1 left join t2 on t1.c1 = t2.c1 set t2.c2 = "t2c2-1";
+update t1 left join t2 on t1.c1 = t2.c1 set t2.c2 = "t2c2-1" where t1.c3 = 10;
diff --git a/mysql-test/t/update.test b/mysql-test/t/update.test
index 1850564418c..fdf6a57cc11 100644
--- a/mysql-test/t/update.test
+++ b/mysql-test/t/update.test
@@ -155,3 +155,12 @@ SELECT * FROM t2;
 DROP TABLE t1;
 DROP TABLE t2;
 
+#
+# Bug #6054 
+#
+drop table if exists t1, t2;
+create table t1 (c1 int, c2 char(6), c3 int);
+create table t2 (c1 int, c2 char(6));
+insert into t1 values (1, "t1c2-1", 10), (2, "t1c2-2", 20);
+update t1 left join t2 on t1.c1 = t2.c1 set t2.c2 = "t2c2-1";
+update t1 left join t2 on t1.c1 = t2.c1 set t2.c2 = "t2c2-1" where t1.c3 = 10;

From cc6a30214c9b2e5f072115dededa10c9e960d296 Mon Sep 17 00:00:00 2001
From: "timour@mysql.com" <>
Date: Thu, 16 Dec 2004 18:44:39 +0200
Subject: [PATCH 2/7] Moved drop table statement to the end.

---
 mysql-test/r/update.result | 1 +
 mysql-test/t/update.test   | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/mysql-test/r/update.result b/mysql-test/r/update.result
index 08b7f942ccc..2d0903a4dae 100644
--- a/mysql-test/r/update.result
+++ b/mysql-test/r/update.result
@@ -209,3 +209,4 @@ create table t2 (c1 int, c2 char(6));
 insert into t1 values (1, "t1c2-1", 10), (2, "t1c2-2", 20);
 update t1 left join t2 on t1.c1 = t2.c1 set t2.c2 = "t2c2-1";
 update t1 left join t2 on t1.c1 = t2.c1 set t2.c2 = "t2c2-1" where t1.c3 = 10;
+drop table t1, t2;
diff --git a/mysql-test/t/update.test b/mysql-test/t/update.test
index fdf6a57cc11..62439dcc51b 100644
--- a/mysql-test/t/update.test
+++ b/mysql-test/t/update.test
@@ -158,9 +158,9 @@ DROP TABLE t2;
 #
 # Bug #6054 
 #
-drop table if exists t1, t2;
 create table t1 (c1 int, c2 char(6), c3 int);
 create table t2 (c1 int, c2 char(6));
 insert into t1 values (1, "t1c2-1", 10), (2, "t1c2-2", 20);
 update t1 left join t2 on t1.c1 = t2.c1 set t2.c2 = "t2c2-1";
 update t1 left join t2 on t1.c1 = t2.c1 set t2.c2 = "t2c2-1" where t1.c3 = 10;
+drop table t1, t2;

From 587584f135ec0eeb67a3478a9318a333aa72d9bc Mon Sep 17 00:00:00 2001
From: "joerg@mysql.com" <>
Date: Thu, 16 Dec 2004 20:26:24 +0100
Subject: [PATCH 3/7] Have 'mysql-test-run' write a list of all failed tests at
 the end, if run with '--force'.

---
 mysql-test/mysql-test-run.sh | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/mysql-test/mysql-test-run.sh b/mysql-test/mysql-test-run.sh
index d47560fe7a6..b760309bb5b 100644
--- a/mysql-test/mysql-test-run.sh
+++ b/mysql-test/mysql-test-run.sh
@@ -4,6 +4,7 @@
 # Sligtly updated by Monty
 # Cleaned up again by Matt
 # Fixed by Sergei
+# List of failed cases (--force) backported from 4.1 by Joerg
 # :-)
 
 #++
@@ -202,6 +203,7 @@ MYSQL_MANAGER_LOG=$MYSQL_TEST_DIR/var/log/manager.log
 MYSQL_MANAGER_USER=root
 NO_SLAVE=0
 USER_TEST=
+FAILED_CASES=
 
 EXTRA_MASTER_OPT=""
 EXTRA_MYSQL_TEST_OPT=""
@@ -1333,7 +1335,7 @@ run_testcase ()
 	show_failed_diff $result_file
 	$ECHO
 	if [ x$FORCE != x1 ] ; then
-	 $ECHO "Aborting. To continue, re-run with '--force'."
+	 $ECHO "Aborting: $tname failed. To continue, re-run with '--force'."
 	 $ECHO
          if [ -z "$DO_GDB" ] && [ -z "$USE_RUNNING_SERVER" ] && [ -z "$DO_DDD" ]
 	 then
@@ -1342,7 +1344,7 @@ run_testcase ()
    	 fi
 	 exit 1
 	fi
-
+	FAILED_CASES="$FAILED_CASES $tname"
         if [ -z "$DO_GDB" ] && [ -z "$USE_RUNNING_SERVER" ] && [ -z "$DO_DDD" ]
 	then
 	  mysql_restart
@@ -1485,4 +1487,10 @@ $ECHO
 [ "$DO_GCOV" ] && gcov_collect # collect coverage information
 [ "$DO_GPROF" ] && gprof_collect # collect coverage information
 
-exit 0
+if [ $TOT_FAIL -ne 0 ]; then
+  $ECHO "mysql-test-run: *** Failing the test(s):$FAILED_CASES"
+  $ECHO
+  exit 1
+else
+  exit 0
+fi

From 3047649845ff441af0690cb5e27f2d72b9d200f5 Mon Sep 17 00:00:00 2001
From: "antony@ltantony.rdg.cyberkinetica.homeunix.net" <>
Date: Sat, 18 Dec 2004 02:07:32 +0000
Subject: [PATCH 4/7] Bug#7391 - Multi-table UPDATE security regression   Add
 in missing privilege checks.   Tests for the privileges.

---
 mysql-test/r/grant.result | 64 ++++++++++++++++++++++++++++++++++
 mysql-test/t/grant.test   | 72 +++++++++++++++++++++++++++++++++++++++
 sql/sql_update.cc         | 20 +++++++++++
 3 files changed, 156 insertions(+)

diff --git a/mysql-test/r/grant.result b/mysql-test/r/grant.result
index f0e5d16e916..2a433e3d5db 100644
--- a/mysql-test/r/grant.result
+++ b/mysql-test/r/grant.result
@@ -156,3 +156,67 @@ select host,db,user,select_priv,insert_priv from mysql.db where db="db6123";
 host	db	user	select_priv	insert_priv
 delete from mysql.user where user='test6123';
 drop database db6123;
+create database mysqltest_1;
+create database mysqltest_2;
+create table mysqltest_1.t1 select 1 a, 2 q;
+create table mysqltest_1.t2 select 1 b, 2 r;
+create table mysqltest_2.t1 select 1 c, 2 s;
+create table mysqltest_2.t2 select 1 d, 2 t;
+grant update (a) on mysqltest_1.t1 to mysqltest_3@localhost;
+grant select (b) on mysqltest_1.t2 to mysqltest_3@localhost;
+grant select (c) on mysqltest_2.t1 to mysqltest_3@localhost;
+grant update (d) on mysqltest_2.t2 to mysqltest_3@localhost;
+show grants for mysqltest_3@localhost;
+Grants for mysqltest_3@localhost
+GRANT USAGE ON *.* TO 'mysqltest_3'@'localhost'
+GRANT SELECT (b) ON `mysqltest_1`.`t2` TO 'mysqltest_3'@'localhost'
+GRANT SELECT (c) ON `mysqltest_2`.`t1` TO 'mysqltest_3'@'localhost'
+GRANT UPDATE (a) ON `mysqltest_1`.`t1` TO 'mysqltest_3'@'localhost'
+GRANT UPDATE (d) ON `mysqltest_2`.`t2` TO 'mysqltest_3'@'localhost'
+update mysqltest_1.t1, mysqltest_1.t2 set q=10 where b=1;
+UPDATE command denied to user: 'mysqltest_3@localhost' for column 'q' in table 't1'
+update mysqltest_1.t1, mysqltest_2.t2 set d=20 where d=1;
+select command denied to user: 'mysqltest_3@localhost' for table 't1'
+update mysqltest_2.t1, mysqltest_1.t2 set c=20 where b=1;
+UPDATE command denied to user: 'mysqltest_3@localhost' for column 'c' in table 't1'
+update mysqltest_2.t1, mysqltest_2.t2 set d=10 where s=2;
+SELECT command denied to user: 'mysqltest_3@localhost' for column 's' in table 't1'
+update mysqltest_1.t1, mysqltest_2.t2 set a=10,d=10;
+update mysqltest_1.t1, mysqltest_2.t1 set a=20 where c=20;
+select t1.*,t2.* from mysqltest_1.t1,mysqltest_1.t2;
+a	q	b	r
+10	2	1	2
+select t1.*,t2.* from mysqltest_2.t1,mysqltest_2.t2;
+c	s	d	t
+1	2	10	2
+revoke all on mysqltest_1.t1 from mysqltest_3@localhost;
+revoke all on mysqltest_1.t2 from mysqltest_3@localhost;
+revoke all on mysqltest_2.t1 from mysqltest_3@localhost;
+revoke all on mysqltest_2.t2 from mysqltest_3@localhost;
+grant all on mysqltest_2.* to mysqltest_3@localhost;
+grant select on *.* to mysqltest_3@localhost;
+flush privileges;
+use mysqltest_1;
+update mysqltest_2.t1, mysqltest_2.t2 set c=500,d=600;
+update mysqltest_1.t1, mysqltest_1.t2 set a=100,b=200;
+UPDATE command denied to user: 'mysqltest_3@localhost' for column 'a' in table 't1'
+use mysqltest_2;
+update mysqltest_1.t1, mysqltest_1.t2 set a=100,b=200;
+Access denied for user: 'mysqltest_3@localhost' to database 'mysqltest_1'
+update mysqltest_2.t1, mysqltest_1.t2 set c=100,b=200;
+Access denied for user: 'mysqltest_3@localhost' to database 'mysqltest_1'
+update mysqltest_1.t1, mysqltest_2.t2 set a=100,d=200;
+Access denied for user: 'mysqltest_3@localhost' to database 'mysqltest_1'
+select t1.*,t2.* from mysqltest_1.t1,mysqltest_1.t2;
+a	q	b	r
+10	2	1	2
+select t1.*,t2.* from mysqltest_2.t1,mysqltest_2.t2;
+c	s	d	t
+500	2	600	2
+delete from mysql.user where user='mysqltest_3';
+delete from mysql.db where user="mysqltest_3";
+delete from mysql.tables_priv where user="mysqltest_3";
+delete from mysql.columns_priv where user="mysqltest_3";
+flush privileges;
+drop database mysqltest_1;
+drop database mysqltest_2;
diff --git a/mysql-test/t/grant.test b/mysql-test/t/grant.test
index 21173a356ce..d9b4be04de3 100644
--- a/mysql-test/t/grant.test
+++ b/mysql-test/t/grant.test
@@ -2,6 +2,8 @@
 drop table if exists t1;
 --enable_warnings
 
+connect (master,localhost,root,,);
+connection master;
 #
 # Test that SSL options works properly
 #
@@ -114,3 +116,73 @@ grant usage on db6123.* to test6123 identified by 'magic123';
 select host,db,user,select_priv,insert_priv from mysql.db where db="db6123";
 delete from mysql.user where user='test6123';
 drop database db6123;
+
+#
+# Bug#7391: Cross-database multi-table UPDATE security problem
+#
+create database mysqltest_1;
+create database mysqltest_2;
+create table mysqltest_1.t1 select 1 a, 2 q;
+create table mysqltest_1.t2 select 1 b, 2 r;
+create table mysqltest_2.t1 select 1 c, 2 s;
+create table mysqltest_2.t2 select 1 d, 2 t;
+
+#test the column privileges
+grant update (a) on mysqltest_1.t1 to mysqltest_3@localhost;
+grant select (b) on mysqltest_1.t2 to mysqltest_3@localhost;
+grant select (c) on mysqltest_2.t1 to mysqltest_3@localhost;
+grant update (d) on mysqltest_2.t2 to mysqltest_3@localhost;
+connect (conn1,localhost,mysqltest_3,,);
+connection conn1;
+show grants for mysqltest_3@localhost;
+--error 1143
+update mysqltest_1.t1, mysqltest_1.t2 set q=10 where b=1;
+--error 1142
+update mysqltest_1.t1, mysqltest_2.t2 set d=20 where d=1;
+--error 1143
+update mysqltest_2.t1, mysqltest_1.t2 set c=20 where b=1;
+--error 1143
+update mysqltest_2.t1, mysqltest_2.t2 set d=10 where s=2;
+#the following two should work
+update mysqltest_1.t1, mysqltest_2.t2 set a=10,d=10;
+update mysqltest_1.t1, mysqltest_2.t1 set a=20 where c=20;
+connection master;
+select t1.*,t2.* from mysqltest_1.t1,mysqltest_1.t2;
+select t1.*,t2.* from mysqltest_2.t1,mysqltest_2.t2;
+revoke all on mysqltest_1.t1 from mysqltest_3@localhost;
+revoke all on mysqltest_1.t2 from mysqltest_3@localhost;
+revoke all on mysqltest_2.t1 from mysqltest_3@localhost;
+revoke all on mysqltest_2.t2 from mysqltest_3@localhost;
+
+#test the db/table level privileges
+grant all on mysqltest_2.* to mysqltest_3@localhost;
+grant select on *.* to mysqltest_3@localhost;
+flush privileges;
+disconnect conn1;
+connect (conn2,localhost,mysqltest_3,,);
+connection conn2;
+use mysqltest_1;
+update mysqltest_2.t1, mysqltest_2.t2 set c=500,d=600;
+# the following failed before, should fail now.
+--error 1143
+update mysqltest_1.t1, mysqltest_1.t2 set a=100,b=200;
+use mysqltest_2;
+#the following used to succeed, it must fail now.
+--error 1044
+update mysqltest_1.t1, mysqltest_1.t2 set a=100,b=200;
+--error 1044
+update mysqltest_2.t1, mysqltest_1.t2 set c=100,b=200;
+--error 1044
+update mysqltest_1.t1, mysqltest_2.t2 set a=100,d=200;
+#lets see the result
+connection master;
+select t1.*,t2.* from mysqltest_1.t1,mysqltest_1.t2;
+select t1.*,t2.* from mysqltest_2.t1,mysqltest_2.t2;
+
+delete from mysql.user where user='mysqltest_3';
+delete from mysql.db where user="mysqltest_3";
+delete from mysql.tables_priv where user="mysqltest_3";
+delete from mysql.columns_priv where user="mysqltest_3";
+flush privileges;
+drop database mysqltest_1;
+drop database mysqltest_2;
diff --git a/sql/sql_update.cc b/sql/sql_update.cc
index cdcc90e8651..f7355f2e9b6 100644
--- a/sql/sql_update.cc
+++ b/sql/sql_update.cc
@@ -465,21 +465,34 @@ int mysql_multi_update(THD *thd,
     */
     for (tl= table_list ; tl ; tl=tl->next)
     {
+      TABLE_LIST *save= tl->next;
       TABLE *table= tl->table;
+      uint wants;
+      tl->next= 0;
       if (update_map & table->map) 
       {
 	DBUG_PRINT("info",("setting table `%s` for update", tl->alias));
 	tl->lock_type= thd->lex.lock_option;
 	tl->updating= 1;
+	wants= UPDATE_ACL;
       }
       else
       {
 	DBUG_PRINT("info",("setting table `%s` for read-only", tl->alias));
 	tl->lock_type= TL_READ;
 	tl->updating= 0;
+	wants= SELECT_ACL;
       }
       if (!using_lock_tables)
 	tl->table->reginfo.lock_type= tl->lock_type;
+
+      if (check_access(thd, wants, tl->db, &tl->grant.privilege, 0, 0) ||
+          (grant_option && check_grant(thd, wants, tl, 0, 0)))
+      {
+	tl->next= save;
+	DBUG_RETURN(0);
+      }
+      tl->next= save;
     }
 
     /* Relock the tables with the correct modes */
@@ -541,6 +554,13 @@ int mysql_multi_update(THD *thd,
     }
   }
 
+  /*
+    If we have no WHERE clause, make it true otherwise the Select
+    examines the privileges
+  */
+  if (!conds)
+    conds= new Item_int("1", 1LL, 1);
+  
   if (!(result=new multi_update(thd, table_list, fields, values,
 				handle_duplicates)))
     DBUG_RETURN(-1);

From 1e07c1a6c13e2f63d01950ff4e597a40689f04f5 Mon Sep 17 00:00:00 2001
From: "antony@ltantony.rdg.cyberkinetica.homeunix.net" <>
Date: Sat, 18 Dec 2004 02:34:11 +0000
Subject: [PATCH 5/7] Remove bogus lines

---
 sql/sql_update.cc | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/sql/sql_update.cc b/sql/sql_update.cc
index f7355f2e9b6..4f7e34ec74f 100644
--- a/sql/sql_update.cc
+++ b/sql/sql_update.cc
@@ -554,13 +554,6 @@ int mysql_multi_update(THD *thd,
     }
   }
 
-  /*
-    If we have no WHERE clause, make it true otherwise the Select
-    examines the privileges
-  */
-  if (!conds)
-    conds= new Item_int("1", 1LL, 1);
-  
   if (!(result=new multi_update(thd, table_list, fields, values,
 				handle_duplicates)))
     DBUG_RETURN(-1);

From eb83e8a046d98f1a628e600f0044c6f9f06f194f Mon Sep 17 00:00:00 2001
From: "monty@mysql.com" <>
Date: Sat, 18 Dec 2004 13:45:19 +0200
Subject: [PATCH 6/7] Simplify code during review

---
 sql/sql_select.cc | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 2df0d45f8ed..eda4ce73186 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -4951,10 +4951,7 @@ join_read_system(JOIN_TAB *tab)
 	table->file->print_error(error,MYF(0));
 	return 1;
       }
-      if (tab->on_expr)
-        mark_as_null_row(tab->table);
-      else
-        table->null_row=1;			// Why do this for inner join?
+      mark_as_null_row(tab->table);
       empty_record(table);			// Make empty record
       return -1;
     }
@@ -4984,10 +4981,7 @@ join_read_const(JOIN_TAB *tab)
     }
     if (error)
     {
-      if (tab->on_expr)
-        mark_as_null_row(tab->table);
-      else
-        table->null_row=1;
+      mark_as_null_row(tab->table);
       empty_record(table);
       if (error != HA_ERR_KEY_NOT_FOUND)
       {

From a524018ab3cf930242974ad02c245c142041695c Mon Sep 17 00:00:00 2001
From: "antony@ltantony.rdg.cyberkinetica.homeunix.net" <>
Date: Sat, 18 Dec 2004 11:57:17 +0000
Subject: [PATCH 7/7] Fix test

---
 mysql-test/r/update.result | 1 -
 1 file changed, 1 deletion(-)

diff --git a/mysql-test/r/update.result b/mysql-test/r/update.result
index 2d0903a4dae..7810d52d156 100644
--- a/mysql-test/r/update.result
+++ b/mysql-test/r/update.result
@@ -203,7 +203,6 @@ colC	colA	colD	colE	colF
 3	4433	10005	492	500
 DROP TABLE t1;
 DROP TABLE t2;
-drop table if exists t1, t2;
 create table t1 (c1 int, c2 char(6), c3 int);
 create table t2 (c1 int, c2 char(6));
 insert into t1 values (1, "t1c2-1", 10), (2, "t1c2-2", 20);