From a37b97159543f44fa6625827d917992be88c5d69 Mon Sep 17 00:00:00 2001
From: "tim@threads.polyesthetic.msg" <>
Date: Tue, 22 May 2001 16:21:07 -0400
Subject: [PATCH] Security fix: LOCK TABLES must check for sufficient
 privileges.

---
 sql/sql_parse.cc | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 7a94dc32997..e420918e06d 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -1851,6 +1851,15 @@ mysql_execute_command(void)
     }
     if (check_db_used(thd,tables) || end_active_trans(thd))
       goto error;
+    for (TABLE_LIST *tmp = tables; tmp; tmp = tmp->next)
+    {
+      if (!(tmp->lock_type == TL_READ_NO_INSERT ?
+            !check_table_access(thd, SELECT_ACL, tmp) :
+            (!check_table_access(thd, INSERT_ACL, tmp) ||
+             !check_table_access(thd, UPDATE_ACL, tmp) ||
+             !check_table_access(thd, DELETE_ACL, tmp))))
+         goto error;
+    }
     thd->in_lock_tables=1;
     if (!(res=open_and_lock_tables(thd,tables)))
     {