database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-27 18:02:13 +03:00
Code Activity

Bug#51770: UNINSTALL PLUGIN requires no privileges

Browse Source 
The problem was that UNINSTALL PLUGIN wasn't performing privilege
checks before removing a plugin. Any user (including users without 
any kind of privileges) could uninstall any plugin.

The solution is to verify if the user has the DELETE privilege for
the mysql.plugin table before uninstalling a plugin.

mysql-test/r/plugin_not_embedded.result:
  Add test case result for Bug#51770.
mysql-test/t/plugin_not_embedded-master.opt:
  Add example plugin path.
mysql-test/t/plugin_not_embedded.test:
  Add test case for Bug#51770.
  Skip embedded as test relies on privileges checks.
This commit is contained in:
Davi Arnaut
2010-03-09 09:16:17 -03:00
parent b8132a8d94
commit 81ffd72a58
4 changed files with 34 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
sql/sql_plugin.cc
View File

@ -1736,6 +1736,8 @@ bool mysql_uninstall_plugin(THD *thd, const LEX_STRING *name)
bzero(&tables, sizeof(tables));
tables.db= (char *)"mysql";
tables.table_name= tables.alias= (char *)"plugin";
if (check_table_access(thd, DELETE_ACL, &tables, 1, FALSE))
DBUG_RETURN(TRUE);
/* need to open before acquiring LOCK_plugin or it will deadlock */
if (! (table= open_ltable(thd, &tables, TL_WRITE, 0)))