From d6cf50ca8b6fa7d4ddec56f2403ee8ada2e0c9ab Mon Sep 17 00:00:00 2001
From: unknown <andrey@lmy004.>
Date: Fri, 23 Jun 2006 17:29:01 +0200
Subject: [PATCH] Fix for bug #18897 "Events: unauthorized action possible with
 alter event rename".

ALTER EVENT ... RENAME statement hasn't checked privileges
for the target database. It also caused server crashes when
target database was not specified explicitly and there was
no current database.

This fix adds missing privilege check and check for the case
when target database is not specified explicitly or implicitly.


mysql-test/r/events_bugs.result:
  update result
mysql-test/t/events_bugs.test:
  add test case for bug 18897 Events: unauthorized action possible with alter event
  rename:
  - test rename to db the user does not have access to
  - test rename when there is no selected db
sql/sql_parse.cc:
  Additional check for the situation when no db is selected.
  CREATE EVENT abc and ALTER EVENT db.abc RENAME TO xyz,
  and DROP EVENT abc
  won't work if there is no selected DB.
---
 mysql-test/r/events_bugs.result | 23 ++++++++++++++++++++++
 mysql-test/t/events_bugs.test   | 34 +++++++++++++++++++++++++++++++++
 sql/sql_parse.cc                |  9 +++++++--
 3 files changed, 64 insertions(+), 2 deletions(-)

diff --git a/mysql-test/r/events_bugs.result b/mysql-test/r/events_bugs.result
index bc89c692f9a..a7c2964a253 100644
--- a/mysql-test/r/events_bugs.result
+++ b/mysql-test/r/events_bugs.result
@@ -178,4 +178,27 @@ drop procedure ee_16407_6_pendant;
 set global event_scheduler= 2;
 drop table events_smode_test;
 set sql_mode=@old_sql_mode;
+set global event_scheduler=2;
+delete from mysql.user where User like 'mysqltest_%';
+delete from mysql.db where User like 'mysqltest_%';
+flush privileges;
+drop database if exists mysqltest_db1;
+create user mysqltest_user1@localhost;
+create database mysqltest_db1;
+grant event on events_test.* to mysqltest_user1@localhost;
+create event mysqltest_user1 on schedule every 10 second do select 42;
+alter event mysqltest_user1 rename to mysqltest_db1.mysqltest_user1;
+ERROR 42000: Access denied for user 'mysqltest_user1'@'localhost' to database 'mysqltest_db1'
+"Let's test now rename when there is no select DB"
+select database();
+database()
+NULL
+alter event events_test.mysqltest_user1 rename to mysqltest_user1;
+ERROR 3D000: No database selected
+select event_schema, event_name, definer, event_type, status from information_schema.events;
+event_schema	event_name	definer	event_type	status
+events_test	mysqltest_user1	mysqltest_user1@localhost	RECURRING	ENABLED
+drop event events_test.mysqltest_user1;
+drop user mysqltest_user1@localhost;
+drop database mysqltest_db1;
 drop database events_test;
diff --git a/mysql-test/t/events_bugs.test b/mysql-test/t/events_bugs.test
index e3b79a6bd13..12d75fede5c 100644
--- a/mysql-test/t/events_bugs.test
+++ b/mysql-test/t/events_bugs.test
@@ -172,4 +172,38 @@ set sql_mode=@old_sql_mode;
 #
 # End  - 16407: Events: Changes in sql_mode won't be taken into account  
 #
+
+#
+# START - 18897: Events: unauthorized action possible with alter event rename
+#
+set global event_scheduler=2;
+--disable_warnings
+delete from mysql.user where User like 'mysqltest_%';
+delete from mysql.db where User like 'mysqltest_%';
+flush privileges;
+drop database if exists mysqltest_db1;
+--enable_warnings
+create user mysqltest_user1@localhost;
+create database mysqltest_db1;
+grant event on events_test.* to mysqltest_user1@localhost;
+connect (conn2,localhost,mysqltest_user1,,events_test);
+create event mysqltest_user1 on schedule every 10 second do select 42;
+--error ER_DBACCESS_DENIED_ERROR
+alter event mysqltest_user1 rename to mysqltest_db1.mysqltest_user1;
+--echo "Let's test now rename when there is no select DB"
+disconnect conn2;
+connect (conn2,localhost,mysqltest_user1,,*NO-ONE*);
+select database();
+--error ER_NO_DB_ERROR
+alter event events_test.mysqltest_user1 rename to mysqltest_user1;
+select event_schema, event_name, definer, event_type, status from information_schema.events;
+drop event events_test.mysqltest_user1;
+disconnect conn2;
+connection default;
+drop user mysqltest_user1@localhost;
+drop database mysqltest_db1;
+#
+# END   - 18897: Events: unauthorized action possible with alter event rename
+#
+
 drop database events_test;
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 14847a9906d..2c92c98db5f 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -3823,7 +3823,9 @@ end_with_restore_list:
     uint rows_affected= 1;
     DBUG_ASSERT(lex->et);
     do {
-      if (! lex->et->dbname.str)
+      if (! lex->et->dbname.str ||
+          (lex->sql_command == SQLCOM_ALTER_EVENT && lex->spname &&
+           !lex->spname->m_db.str))
       {
         my_message(ER_NO_DB_ERROR, ER(ER_NO_DB_ERROR), MYF(0));
         res= true;
@@ -3831,7 +3833,10 @@ end_with_restore_list:
       }
 
       if (check_access(thd, EVENT_ACL, lex->et->dbname.str, 0, 0, 0,
-                       is_schema_db(lex->et->dbname.str)))
+                       is_schema_db(lex->et->dbname.str)) ||
+          (lex->sql_command == SQLCOM_ALTER_EVENT && lex->spname &&
+           (check_access(thd, EVENT_ACL, lex->spname->m_db.str, 0, 0, 0,
+                         is_schema_db(lex->spname->m_db.str)))))
         break;
 
       if (end_active_trans(thd))