mirror of
https://github.com/MariaDB/server.git
synced 2025-11-12 10:22:39 +03:00
857b59578c
SQL SECURITY DEFINER must enforce reduced rights too, not just additional rights. mysql-test/r/sp-security.result: Test case for BUG#2777: Make sure that SQL SECURITY DEFINER enforces reduced rights. mysql-test/t/sp-security.test: Test case for BUG#2777: Make sure that SQL SECURITY DEFINER enforces reduced rights. sql/sql_acl.cc: Clear rights before changing them in acl_getroot_no_password so that reduced rights work too, and take care of db acls as well.
83 lines
2.2 KiB
Plaintext
83 lines
2.2 KiB
Plaintext
use test;
|
|
grant usage on *.* to user1@localhost;
|
|
flush privileges;
|
|
drop database if exists db1_secret;
|
|
create database db1_secret;
|
|
use db1_secret;
|
|
create table t1 ( u varchar(64), i int );
|
|
create procedure stamp(i int)
|
|
insert into db1_secret.t1 values (user(), i);
|
|
show procedure status like 'stamp';
|
|
Name Type Definer Modified Created Security_type Comment
|
|
stamp PROCEDURE root@localhost 0000-00-00 00:00:00 0000-00-00 00:00:00 DEFINER
|
|
call stamp(1);
|
|
select * from t1;
|
|
u i
|
|
root@localhost 1
|
|
call stamp(2);
|
|
select * from db1_secret.t1;
|
|
ERROR 42000: Access denied for user: 'user1'@'localhost' to database 'db1_secret'
|
|
call stamp(3);
|
|
select * from db1_secret.t1;
|
|
ERROR 42000: Access denied for user: ''@'localhost' to database 'db1_secret'
|
|
select * from t1;
|
|
u i
|
|
root@localhost 1
|
|
user1@localhost 2
|
|
anon@localhost 3
|
|
alter procedure stamp sql security invoker;
|
|
show procedure status like 'stamp';
|
|
Name Type Definer Modified Created Security_type Comment
|
|
stamp PROCEDURE root@localhost 0000-00-00 00:00:00 0000-00-00 00:00:00 INVOKER
|
|
call stamp(4);
|
|
select * from t1;
|
|
u i
|
|
root@localhost 1
|
|
user1@localhost 2
|
|
anon@localhost 3
|
|
root@localhost 4
|
|
call stamp(5);
|
|
ERROR 42000: Access denied for user: 'user1'@'localhost' to database 'db1_secret'
|
|
call stamp(6);
|
|
ERROR 42000: Access denied for user: ''@'localhost' to database 'db1_secret'
|
|
drop database if exists db2;
|
|
create database db2;
|
|
use db2;
|
|
create table t2 (s1 int);
|
|
insert into t2 values (0);
|
|
grant usage on db2.* to user1@localhost;
|
|
grant select on db2.* to user1@localhost;
|
|
grant usage on db2.* to user2@localhost;
|
|
grant select,insert,update,delete on db2.* to user2@localhost;
|
|
flush privileges;
|
|
use db2;
|
|
create procedure p () insert into t2 values (1);
|
|
call p();
|
|
ERROR 42000: Access denied for user: 'user1'@'localhost' to database 'db2'
|
|
use db2;
|
|
call p();
|
|
ERROR 42000: Access denied for user: 'user1'@'localhost' to database 'db2'
|
|
select * from t2;
|
|
s1
|
|
0
|
|
create procedure q () insert into t2 values (2);
|
|
call q();
|
|
select * from t2;
|
|
s1
|
|
0
|
|
2
|
|
use db2;
|
|
call q();
|
|
select * from t2;
|
|
s1
|
|
0
|
|
2
|
|
2
|
|
drop procedure stamp;
|
|
drop procedure p;
|
|
drop procedure q;
|
|
use test;
|
|
drop database db1_secret;
|
|
drop database db2;
|
|
delete from mysql.user where user='user1' or user='user2';
|