database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-12-24 11:21:21 +03:00
Code Activity

Bug #11764517: 57359: POSSIBLE TO CIRCUMVENT SECURE_FILE_PRIV

Browse Source 
USING '..' ON WINDOWS

Backport of the fix to 5.0 (to be null-merged to 5.1).
Moved the test into the main test suite. 
Made mysql-test-run.pl to not use symlinks for sdtdata as the symlinks
are now properly recognized by secure_file_priv.
Made sure the paths in load_file(), LOAD DATA and SELECT .. INTO OUTFILE 
that are checked against secure_file_priv in a correct way similarly to 5.1 
by the extended is_secure_file_path() backport before the comparison.
Added an extensive test with all the variants of upper/lower case, 
slash/backslash and case sensitivity.
Added few comments to the code.
This commit is contained in:
Georgi Kodinov
2011-04-28 12:22:41 +03:00
parent 0d2f7502b5
commit 59d7516005
10 changed files with 228 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
mysql-test/mysql-test-run.pl
View File

@@ -2412,17 +2412,9 @@ sub setup_vardir() {
mkpath("$data_dir/test");
}
# Make a link std_data_ln in var/ that points to std_data
if ( ! $glob_win32 )
{
symlink("$glob_mysql_test_dir/std_data", "$opt_vardir/std_data_ln");
}
else
{
# on windows, copy all files from std_data into var/std_data_ln
mkpath("$opt_vardir/std_data_ln");
mtr_copy_dir("$glob_mysql_test_dir/std_data", "$opt_vardir/std_data_ln");
}
# copy all files from std_data into var/std_data_ln
mkpath("$opt_vardir/std_data_ln");
mtr_copy_dir("$glob_mysql_test_dir/std_data", "$opt_vardir/std_data_ln");
# Remove old log files
foreach my $name (glob("r/*.progress r/*.log r/*.warnings"))