database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-12-24 11:21:21 +03:00
Code Activity

Bug#50373 --secure-file-priv=""

Browse Source 
Iterative patch improvement. Previously committed patch
caused wrong result on Windows. The previous patch also
broke secure_file_priv for symlinks since not all file
paths which must be compared against this variable are
normalized using the same norm.

The server variable opt_secure_file_priv wasn't
normalized properly and caused the operations
LOAD DATA INFILE .. INTO TABLE ..
and
SELECT load_file(..)
to do different interpretations of the 
--secure-file-priv option.
     
The patch moves code to the server initialization
routines so that the path always is normalized
once and only once.
      
It was also intended that setting the option
to an empty string should be equal to 
lifting all previously set restrictions. This
is also fixed by this patch.
This commit is contained in:
Kristofer Pettersson
2010-05-03 18:14:39 +02:00
parent 0f5afe5d7f
commit 5b6ebdf086
7 changed files with 64 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
mysql-test/r/loaddata.result
View File

@@ -202,12 +202,6 @@ select * from t1;
a b c
10 NULL Ten
15 NULL Fifteen
show variables like "secure_file_pri%";
Variable_name Value
secure_file_priv MYSQLTEST_VARDIR
select @@secure_file_priv;
@@secure_file_priv
MYSQLTEST_VARDIR
set @@secure_file_priv= 0;
ERROR HY000: Variable 'secure_file_priv' is a read only variable
truncate table t1;

14
mysql-test/t/loaddata.test
View File

@@ -153,10 +153,16 @@ select * from t1;
#
# It should not be possible to load from a file outside of vardir
--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
show variables like "secure_file_pri%";
--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
select @@secure_file_priv;
## The following lines were disabled because of patch for
## bug 50373. MYSQLTEST_VARDIR doesn't rewrite symlinks
## to real paths, but this is done for secure_file_priv.
## Because of this the result can't be replaced if the
## test suite runs with the --mem option which creates
## symlinks to the ramdisk.
#--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
#show variables like "secure_file_pri%";
#--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
#select @@secure_file_priv;
--error 1238
set @@secure_file_priv= 0;