mirror of
https://github.com/MariaDB/server.git
synced 2025-12-06 05:42:06 +03:00
3bad2119f9
This patch also fixes bugs 36963 and 35600.
- In many places a view was confused with an anonymous derived
table, i.e. access checking was skipped. Fixed by introducing a
predicate to tell the difference between named and anonymous
derived tables.
- When inserting fields for "SELECT * ", there was no
distinction between base tables and views, where one should be
made. View privileges are checked elsewhere.
mysql-test/include/grant_cache.inc:
Bug#36086: Changed test case.
mysql-test/r/grant2.result:
Bug#36086: Changed test result.
mysql-test/r/grant_cache_no_prot.result:
Bug#36086: Changed test result.
mysql-test/r/grant_cache_ps_prot.result:
Bug#36086: Changed test result.
mysql-test/r/view_grant.result:
Bug#36086: Test result.
mysql-test/t/grant2.test:
Bug#36086: Changed test case.
mysql-test/t/view_grant.test:
Bug#36086: Test case.
sql/item.cc:
Bug#36086: Replaced conditional with new methods.
sql/sql_acl.cc:
Bug no 35600:
In mysql_table_grant:
Replaced conditional with the new accessor method.
In check_grant:
- Changed the requirement table->derived != null to
checking all anonymous derived tables.
- Use of the accessor methods for getting object and database
names.
Bug#36086: In check_grant_all_columns:
- Updated comment. This function is now called for views
as well.
- The error message should not disclose any column names
unless the user has privilege to see all column names.
- Changed names of Field_iterator_table_ref methods.
sql/sql_base.cc:
Bug no 36963: In insert_fields()
- Commented.
- We should call check_grant_all_columns() for views in
this case.
- Changed names of Field_iterator_table_ref methods.
- We should not disclose column names in the error message
when the user has no approprate privilege.
sql/sql_cache.cc:
Bug#36086: Replaced test with new predicate method.
sql/sql_derived.cc:
Bug#36086: commenting only. Updated and doxygenated
comment for mysql_derived_prepare().
sql/sql_parse.cc:
Bug no 35600:
- In check_single_table_access:
Due to the bug, check_grant would raise an error for a
SHOW CREATE TABLE command for a TEMPTABLE view. It should in
fact not be be invoked in this case. This table privilege
is checked already.
There is a test case for this in information_schema_db.test.
- In check_access: replaced table->derived
sql/table.cc:
Bug#36086:
- In TABLE_LIST::set_underlying_merge():
Commenting only. Doxygenated, corrected spelling,
added.
- Renamed table_name() and db_name() methods of
Field_iterator_table_ref in order to be consistent
with new methods in TABLE_LIST.
sql/table.h:
Bug#36086:
- Commented GRANT_INFO.
- Added a predicate is_anonymous_derived_table() to
TABLE_LIST.
- Added get_table_name() and get_db_name() to
TABLE_LIST in order to hide the disparate
representation of these properties.
219 lines
5.5 KiB
Plaintext
219 lines
5.5 KiB
Plaintext
drop table if exists test.t1,mysqltest.t1,mysqltest.t2;
|
|
drop database if exists mysqltest;
|
|
set GLOBAL query_cache_size=1355776;
|
|
reset query cache;
|
|
flush status;
|
|
----- establish connection root -----
|
|
show grants for current_user;
|
|
Grants for root@localhost
|
|
GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION
|
|
show grants;
|
|
Grants for root@localhost
|
|
GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION
|
|
create database if not exists mysqltest;
|
|
create table mysqltest.t1 (a int,b int,c int);
|
|
create table mysqltest.t2 (a int,b int,c int);
|
|
insert into mysqltest.t1 values (1,1,1),(2,2,2);
|
|
insert into mysqltest.t2 values (3,3,3);
|
|
create table test.t1 (a char (10));
|
|
insert into test.t1 values ("test.t1");
|
|
select * from t1;
|
|
a
|
|
test.t1
|
|
----- establish connection root2 -----
|
|
select * from t1;
|
|
a b c
|
|
1 1 1
|
|
2 2 2
|
|
select a from t1;
|
|
a
|
|
1
|
|
2
|
|
select c from t1;
|
|
c
|
|
1
|
|
2
|
|
select * from t2;
|
|
a b c
|
|
3 3 3
|
|
select * from mysqltest.t1,test.t1;
|
|
a b c a
|
|
1 1 1 test.t1
|
|
2 2 2 test.t1
|
|
show status like "Qcache_queries_in_cache";
|
|
Variable_name Value
|
|
Qcache_queries_in_cache 6
|
|
show status like "Qcache_hits%";
|
|
Variable_name Value
|
|
Qcache_hits 0
|
|
grant SELECT on mysqltest.* to mysqltest_1@localhost;
|
|
grant SELECT on mysqltest.t1 to mysqltest_2@localhost;
|
|
grant SELECT on test.t1 to mysqltest_2@localhost;
|
|
grant SELECT(a) on mysqltest.t1 to mysqltest_3@localhost;
|
|
----- establish connection user1 (user=mysqltest_1) -----
|
|
show grants for current_user();
|
|
Grants for mysqltest_1@localhost
|
|
GRANT USAGE ON *.* TO 'mysqltest_1'@'localhost'
|
|
GRANT SELECT ON `mysqltest`.* TO 'mysqltest_1'@'localhost'
|
|
show status like "Qcache_queries_in_cache";
|
|
Variable_name Value
|
|
Qcache_queries_in_cache 6
|
|
show status like "Qcache_hits";
|
|
Variable_name Value
|
|
Qcache_hits 0
|
|
show status like "Qcache_not_cached";
|
|
Variable_name Value
|
|
Qcache_not_cached 0
|
|
select "user1";
|
|
user1
|
|
user1
|
|
show status like "Qcache_queries_in_cache";
|
|
Variable_name Value
|
|
Qcache_queries_in_cache 6
|
|
show status like "Qcache_hits";
|
|
Variable_name Value
|
|
Qcache_hits 0
|
|
show status like "Qcache_not_cached";
|
|
Variable_name Value
|
|
Qcache_not_cached 1
|
|
select * from t1;
|
|
a b c
|
|
1 1 1
|
|
2 2 2
|
|
show status like "Qcache_queries_in_cache";
|
|
Variable_name Value
|
|
Qcache_queries_in_cache 6
|
|
show status like "Qcache_hits";
|
|
Variable_name Value
|
|
Qcache_hits 1
|
|
show status like "Qcache_not_cached";
|
|
Variable_name Value
|
|
Qcache_not_cached 1
|
|
select a from t1 ;
|
|
a
|
|
1
|
|
2
|
|
show status like "Qcache_queries_in_cache";
|
|
Variable_name Value
|
|
Qcache_queries_in_cache 6
|
|
show status like "Qcache_hits";
|
|
Variable_name Value
|
|
Qcache_hits 2
|
|
show status like "Qcache_not_cached";
|
|
Variable_name Value
|
|
Qcache_not_cached 1
|
|
select c from t1;
|
|
c
|
|
1
|
|
2
|
|
show status like "Qcache_queries_in_cache";
|
|
Variable_name Value
|
|
Qcache_queries_in_cache 6
|
|
show status like "Qcache_hits";
|
|
Variable_name Value
|
|
Qcache_hits 3
|
|
show status like "Qcache_not_cached";
|
|
Variable_name Value
|
|
Qcache_not_cached 1
|
|
----- establish connection unkuser (user=unkuser) -----
|
|
show grants for current_user();
|
|
Grants for @localhost
|
|
GRANT USAGE ON *.* TO ''@'localhost'
|
|
----- establish connection user2 (user=mysqltest_2) -----
|
|
select "user2";
|
|
user2
|
|
user2
|
|
select * from t1;
|
|
a b c
|
|
1 1 1
|
|
2 2 2
|
|
select a from t1;
|
|
a
|
|
1
|
|
2
|
|
select c from t1;
|
|
c
|
|
1
|
|
2
|
|
select * from mysqltest.t1,test.t1;
|
|
a b c a
|
|
1 1 1 test.t1
|
|
2 2 2 test.t1
|
|
select * from t2;
|
|
ERROR 42000: SELECT command denied to user 'mysqltest_2'@'localhost' for table 't2'
|
|
show status like "Qcache_queries_in_cache";
|
|
Variable_name Value
|
|
Qcache_queries_in_cache 6
|
|
show status like "Qcache_hits";
|
|
Variable_name Value
|
|
Qcache_hits 7
|
|
show status like "Qcache_not_cached";
|
|
Variable_name Value
|
|
Qcache_not_cached 2
|
|
----- establish connection user3 (user=mysqltest_3) -----
|
|
select "user3";
|
|
user3
|
|
user3
|
|
select * from t1;
|
|
ERROR 42000: SELECT command denied to user 'mysqltest_3'@'localhost' for table 't1'
|
|
select a from t1;
|
|
a
|
|
1
|
|
2
|
|
select c from t1;
|
|
ERROR 42000: SELECT command denied to user 'mysqltest_3'@'localhost' for column 'c' in table 't1'
|
|
select * from t2;
|
|
ERROR 42000: SELECT command denied to user 'mysqltest_3'@'localhost' for table 't2'
|
|
select mysqltest.t1.c from test.t1,mysqltest.t1;
|
|
ERROR 42000: SELECT command denied to user 'mysqltest_3'@'localhost' for column 'c' in table 't1'
|
|
show status like "Qcache_queries_in_cache";
|
|
Variable_name Value
|
|
Qcache_queries_in_cache 6
|
|
show status like "Qcache_hits";
|
|
Variable_name Value
|
|
Qcache_hits 7
|
|
show status like "Qcache_not_cached";
|
|
Variable_name Value
|
|
Qcache_not_cached 7
|
|
----- establish connection user4 (user=mysqltest_1) -----
|
|
select "user4";
|
|
user4
|
|
user4
|
|
show grants;
|
|
Grants for mysqltest_1@localhost
|
|
GRANT USAGE ON *.* TO 'mysqltest_1'@'localhost'
|
|
GRANT SELECT ON `mysqltest`.* TO 'mysqltest_1'@'localhost'
|
|
select a from t1;
|
|
ERROR 3D000: No database selected
|
|
select * from mysqltest.t1,test.t1;
|
|
a b c a
|
|
1 1 1 test.t1
|
|
2 2 2 test.t1
|
|
select a from mysqltest.t1;
|
|
a
|
|
1
|
|
2
|
|
select a from mysqltest.t1;
|
|
a
|
|
1
|
|
2
|
|
show status like "Qcache_queries_in_cache";
|
|
Variable_name Value
|
|
Qcache_queries_in_cache 8
|
|
show status like "Qcache_hits";
|
|
Variable_name Value
|
|
Qcache_hits 8
|
|
show status like "Qcache_not_cached";
|
|
Variable_name Value
|
|
Qcache_not_cached 8
|
|
----- switch to connection default and close connections -----
|
|
set names binary;
|
|
delete from mysql.user where user in ("mysqltest_1","mysqltest_2","mysqltest_3");
|
|
delete from mysql.db where user in ("mysqltest_1","mysqltest_2","mysqltest_3");
|
|
delete from mysql.tables_priv where user in ("mysqltest_1","mysqltest_2","mysqltest_3");
|
|
delete from mysql.columns_priv where user in ("mysqltest_1","mysqltest_2","mysqltest_3");
|
|
flush privileges;
|
|
drop table test.t1,mysqltest.t1,mysqltest.t2;
|
|
drop database mysqltest;
|
|
set GLOBAL query_cache_size=default;
|