evgen@moonbone.local 34f478121f Bug#27878: Unchecked privileges on a view referring to a table from another ...

database.

If a user has a right to update anything in the current database then the 
access was granted and further checks of access rights for underlying tables
wasn't done correctly. The check is done before a view is opened and thus no
check of access rights for underlying tables can be carried out.
This allows a user to update through a view a table from another database for
which he hasn't enough rights.

Now the mysql_update() and the mysql_test_update() functions are forces
re-checking of access rights after a view is opened.

2007-05-11 23:19:11 +04:00

46 KiB

Raw Blame History

View Raw