database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

5.3 merge

Browse Source
This commit is contained in:
Sergei Golubchik
2012-01-13 15:50:02 +01:00
parent 8c2bcdf85f 6ca4ca7d37
commit 4f435bddfd
750 changed files with 17402 additions and 7153 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
sql/sql_view.cc
View File

@ -847,7 +847,7 @@ static int mysql_register_view(THD *thd, TABLE_LIST *view,
thd->variables.sql_mode|= sql_mode;
}
DBUG_PRINT("info", ("View: %s", view_query.c_ptr_safe()));
DBUG_PRINT("info", ("View: %.*s", view_query.length(), view_query.ptr()));
/* fill structure */
view->source= thd->lex->create_view_select;
@ -1283,6 +1283,37 @@ bool mysql_make_view(THD *thd, File_parser *parser, TABLE_LIST *table,
if (!table->prelocking_placeholder &&
(old_lex->sql_command == SQLCOM_SELECT && old_lex->describe))
{
/*
The user we run EXPLAIN as (either the connected user who issued
the EXPLAIN statement, or the definer of a SUID stored routine
which contains the EXPLAIN) should have both SHOW_VIEW_ACL and
SELECT_ACL on the view being opened as well as on all underlying
views since EXPLAIN will disclose their structure. This user also
should have SELECT_ACL on all underlying tables of the view since
this EXPLAIN will disclose information about the number of rows in it.
To perform this privilege check we create auxiliary TABLE_LIST object
for the view in order a) to avoid trashing "table->grant" member for
original table list element, which contents can be important at later
stage for column-level privilege checking b) get TABLE_LIST object
with "security_ctx" member set to 0, i.e. forcing check_table_access()
to use active user's security context.
There is no need for creating similar copies of TABLE_LIST elements
for underlying tables since they just have been constructed and thus
have TABLE_LIST::security_ctx == 0 and fresh TABLE_LIST::grant member.
Finally at this point making sure we have SHOW_VIEW_ACL on the views
will suffice as we implicitly require SELECT_ACL anyway.
*/
TABLE_LIST view_no_suid;
bzero(static_cast<void *>(&view_no_suid), sizeof(TABLE_LIST));
view_no_suid.db= table->db;
view_no_suid.table_name= table->table_name;
DBUG_ASSERT(view_tables == NULL || view_tables->security_ctx == NULL);
if (check_table_access(thd, SELECT_ACL, view_tables, FALSE,
UINT_MAX, TRUE) &&
check_table_access(thd, SHOW_VIEW_ACL, table, FALSE, UINT_MAX, TRUE))