database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-30 16:24:05 +03:00
Code Activity

Bug#48319: Server crashes on "GRANT/REVOKE ... TO CURRENT_USER"

Browse Source 
CURRENT_USER() in GRANT ... TO CURRENT_USER() only gave us a definer,
not a full user (i.e., password-element was not initiliazed). Hence
dereferencing the password led to a crash.

Properly initializes definers now, just so there are no misunderstandings.
Also does some magic so IDENTIFIED BY ... works with CURRENT_USER().

mysql-test/r/grant2.result:
  Show GRANT ... TO CURRENT_USER() no longer crashes.
  Show it to work with IDENTIFIED BY to boot.
mysql-test/t/grant2.test:
  Show GRANT ... TO CURRENT_USER() no longer crashes.
  Show it to work with IDENTIFIED BY to boot.
sql/sql_acl.cc:
  Make IDENTIFIED BY ... work with CURRENT_USER()
sql/sql_parse.cc:
  Zero password-part of definer just in case somebody mistakes this for
  a complete LEX_USER!
This commit is contained in:
Tatiana A. Nurnberg
2009-10-29 22:06:10 -07:00
parent 09668c0124
commit be04d1a479
4 changed files with 74 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
mysql-test/r/grant2.result
View File

@ -443,3 +443,30 @@ DROP TABLE db1.t1, db1.t2;
DROP USER mysqltest1@localhost;
DROP DATABASE db1;
End of 5.0 tests
USE mysql;
SELECT LEFT(CURRENT_USER(),INSTR(CURRENT_USER(),'@')-1) INTO @u;
SELECT MID(CURRENT_USER(),INSTR(CURRENT_USER(),'@')+1) INTO @h;
SELECT password FROM user WHERE user=@u AND host=@h INTO @pwd;
SELECT user,host,password,insert_priv FROM user WHERE user=@u AND host=@h;
user host password insert_priv
root localhost Y
UPDATE user SET insert_priv='N' WHERE user=@u AND host=@h;
SELECT user,host,password,insert_priv FROM user WHERE user=@u AND host=@h;
user host password insert_priv
root localhost N
GRANT INSERT ON *.* TO CURRENT_USER();
SELECT user,host,password,insert_priv FROM user WHERE user=@u AND host=@h;
user host password insert_priv
root localhost Y
UPDATE user SET insert_priv='N' WHERE user=@u AND host=@h;
GRANT INSERT ON *.* TO CURRENT_USER() IDENTIFIED BY 'keksdose';
SELECT user,host,password,insert_priv FROM user WHERE user=@u AND host=@h;
user host password insert_priv
root localhost *0BB7188CF0DE9B403BA66E9DD810D82652D002EB Y
UPDATE user SET password=@pwd WHERE user=@u AND host=@h;
SELECT user,host,password,insert_priv FROM user WHERE user=@u AND host=@h;
user host password insert_priv
root localhost Y
FLUSH PRIVILEGES;
USE test;
End of 5.1 tests

35
mysql-test/t/grant2.test
View File

@ -632,5 +632,40 @@ DROP DATABASE db1;
--echo End of 5.0 tests
#
# Bug #48319: Server crashes on "GRANT/REVOKE ... TO CURRENT_USER"
#
# work out who we are.
USE mysql;
SELECT LEFT(CURRENT_USER(),INSTR(CURRENT_USER(),'@')-1) INTO @u;
SELECT MID(CURRENT_USER(),INSTR(CURRENT_USER(),'@')+1) INTO @h;
SELECT password FROM user WHERE user=@u AND host=@h INTO @pwd;
# show current privs.
SELECT user,host,password,insert_priv FROM user WHERE user=@u AND host=@h;
# toggle INSERT
UPDATE user SET insert_priv='N' WHERE user=@u AND host=@h;
SELECT user,host,password,insert_priv FROM user WHERE user=@u AND host=@h;
# show that GRANT ... TO CURRENT_USER() no longer crashes
GRANT INSERT ON *.* TO CURRENT_USER();
SELECT user,host,password,insert_priv FROM user WHERE user=@u AND host=@h;
UPDATE user SET insert_priv='N' WHERE user=@u AND host=@h;
# show that GRANT ... TO CURRENT_USER() IDENTIFIED BY ... works now
GRANT INSERT ON *.* TO CURRENT_USER() IDENTIFIED BY 'keksdose';
SELECT user,host,password,insert_priv FROM user WHERE user=@u AND host=@h;
UPDATE user SET password=@pwd WHERE user=@u AND host=@h;
SELECT user,host,password,insert_priv FROM user WHERE user=@u AND host=@h;
FLUSH PRIVILEGES;
USE test;
--echo End of 5.1 tests
# Wait till we reached the initial number of concurrent sessions
--source include/wait_until_count_sessions.inc