database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-08 11:22:35 +03:00
Code Activity

MDEV-36380 User has unauthorized access to a sequence through a view with security invoker

Browse Source 
check sequence privileges in Item_func_nextval::fix_fields(),
just like column privileges are checked in Item_field::fix_fields()

remove sequence specific hacks that kinda made sequence privilege
checks works, but not in all cases. And they were too lax,
didn't requre SELECT privilege for NEXTVAL. Also INSERT privilege looks
wrong here, UPDATE would've been more appropriate, but won't
change that for compatibility reasons.

also fixes

MDEV-36413 User without any privileges to a sequence can read from it and modify it via column default
This commit is contained in:
Sergei Golubchik
2025-04-11 08:28:42 +02:00
parent f89f8aa313
commit f99586668a
11 changed files with 211 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
mysql-test/suite/sql_sequence/grant.test
View File

@@ -60,10 +60,58 @@ select * from s1;
#
connection default;
drop database mysqltest_1;
drop user 'normal'@'%';
drop user 'read_only'@'%';
drop user 'read_write'@'%';
drop user 'alter'@'%';
drop user 'only_alter'@'%';
drop sequence s1;
--echo #
--echo # MDEV-36413 User without any privileges to a sequence can read from
--echo # it and modify it via column default
--echo #
create sequence s1;
create sequence s2;
select * from s2;
create table t2 (a int not null default(nextval(s1)));
insert into t2 values();
create user u;
grant create, insert, select, drop on mysqltest_1.t1 to u;
grant insert, select on mysqltest_1.s1 to u;
grant select on mysqltest_1.t2 to u;
--connect(con1,localhost,u,,mysqltest_1)
--error ER_TABLEACCESS_DENIED_ERROR
select nextval(s2);
--error ER_TABLEACCESS_DENIED_ERROR
show create sequence s2;
create table t1 (a int not null default(nextval(s1)));
drop table t1;
create table t1 (a int not null default(nextval(s1))) select a from t2;
insert into t1 values();
select * from t1;
drop table t1;
create table t1 (a int not null default(nextval(s1))) select a from (select t2.a from t2,t2 as t3 where t2.a=t3.a) as t4;
drop table t1;
--error ER_TABLEACCESS_DENIED_ERROR
create table t1 (a int not null default(nextval(s2)));
--error ER_TABLEACCESS_DENIED_ERROR
create table t1 (a int not null default(nextval(s1)),
b int not null default(nextval(s2)));
--disconnect con1
--connection default
drop user u;
#
# Cleanup
#
drop database mysqltest_1;
--echo #
--echo # End of 10.11 tests
--echo #