database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

Merge with MySQL 5.1.60

Browse Source
This commit is contained in:
Michael Widenius
2011-11-23 19:32:14 +02:00
parent c8768a091a f28e7bd064
commit 7b368e3810
283 changed files with 11351 additions and 5797 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
sql/sql_view.cc
View File

@ -1267,8 +1267,39 @@ bool mysql_make_view(THD *thd, File_parser *parser, TABLE_LIST *table,
if (!table->prelocking_placeholder &&
(old_lex->sql_command == SQLCOM_SELECT && old_lex->describe))
{
if (check_table_access(thd, SELECT_ACL, view_tables, UINT_MAX, TRUE) &&
check_table_access(thd, SHOW_VIEW_ACL, table, UINT_MAX, TRUE))
/*
The user we run EXPLAIN as (either the connected user who issued
the EXPLAIN statement, or the definer of a SUID stored routine
which contains the EXPLAIN) should have both SHOW_VIEW_ACL and
SELECT_ACL on the view being opened as well as on all underlying
views since EXPLAIN will disclose their structure. This user also
should have SELECT_ACL on all underlying tables of the view since
this EXPLAIN will disclose information about the number of rows in it.
To perform this privilege check we create auxiliary TABLE_LIST object
for the view in order a) to avoid trashing "table->grant" member for
original table list element, which contents can be important at later
stage for column-level privilege checking b) get TABLE_LIST object
with "security_ctx" member set to 0, i.e. forcing check_table_access()
to use active user's security context.
There is no need for creating similar copies of TABLE_LIST elements
for underlying tables since they just have been constructed and thus
have TABLE_LIST::security_ctx == 0 and fresh TABLE_LIST::grant member.
Finally at this point making sure we have SHOW_VIEW_ACL on the views
will suffice as we implicitly require SELECT_ACL anyway.
*/
TABLE_LIST view_no_suid;
bzero(static_cast<void *>(&view_no_suid), sizeof(TABLE_LIST));
view_no_suid.db= table->db;
view_no_suid.table_name= table->table_name;
DBUG_ASSERT(view_tables == NULL || view_tables->security_ctx == NULL);
if (check_table_access(thd, SELECT_ACL, view_tables, UINT_MAX, TRUE) ||
check_table_access(thd, SHOW_VIEW_ACL, &view_no_suid, UINT_MAX, TRUE))
{
my_message(ER_VIEW_NO_EXPLAIN, ER(ER_VIEW_NO_EXPLAIN), MYF(0));
goto err;