From: Date: March 12 2007 8:07pm Subject: bk commit into 5.1 tree (holyfoot:1.2477) BUG#23675 List-Archive: http://lists.mysql.com/commits/21765 X-Bug: 23675 Message-Id: <20070312190737.605DB2C380B7@hfmain.localdomain> Below is the list of changes that have just been committed into a local 5.1 repository of hf. When hf does a push these changes will be propagated to the main repository and, within 24 hours after the push, to the public repository. For information on how to access the public repository see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html ChangeSet@stripped, 2007-03-12 23:07:30+04:00, holyfoot@stripped +7 -0 Bug #23675 Partitions: possible security breach via alter Now we select error message depending on user acess rights mysql-test/r/partition_grant.result@stripped, 2007-03-12 23:07:28+04:00, holyfoot@stripped +10 -1 test result mysql-test/t/partition_grant.test@stripped, 2007-03-12 23:07:28+04:00, holyfoot@stripped +23 -2 testcase sql/mysql_priv.h@stripped, 2007-03-12 23:07:28+04:00, holyfoot@stripped +1 -1 no_errors added to check_single_table_access sql/partition_info.cc@stripped, 2007-03-12 23:07:28+04:00, holyfoot@stripped +12 -1 select error depening on the access rights sql/share/errmsg.txt@stripped, 2007-03-12 23:07:28+04:00, holyfoot@stripped +2 -0 error message added sql/sql_base.cc@stripped, 2007-03-12 23:07:28+04:00, holyfoot@stripped +1 -1 no_errors added to check_single_table_access sql/sql_parse.cc@stripped, 2007-03-12 23:07:28+04:00, holyfoot@stripped +7 -5 no_errors added to check_single_table_access # This is a BitKeeper patch. What follows are the unified diffs for the # set of deltas contained in the patch. The rest of the patch, the part # that BitKeeper cares about, is below these diffs. # User: holyfoot # Host: hfmain.(none) # Root: /home/hf/work/23675/my51-23675 --- 1.485/sql/mysql_priv.h 2007-03-12 23:07:37 +04:00 +++ 1.486/sql/mysql_priv.h 2007-03-12 23:07:37 +04:00 @@ -599,7 +599,7 @@ class THD; void close_thread_tables(THD *thd, bool locked=0, bool skip_derived=0); bool check_one_table_access(THD *thd, ulong privilege, TABLE_LIST *tables); bool check_single_table_access(THD *thd, ulong privilege, - TABLE_LIST *tables); + TABLE_LIST *tables, bool no_errors); bool check_routine_access(THD *thd,ulong want_access,char *db,char *name, bool is_proc, bool no_errors); bool check_some_access(THD *thd, ulong want_access, TABLE_LIST *table); --- 1.385/sql/sql_base.cc 2007-03-12 23:07:37 +04:00 +++ 1.386/sql/sql_base.cc 2007-03-12 23:07:37 +04:00 @@ -5809,7 +5809,7 @@ bool setup_tables_and_check_access(THD * { if (leaves_tmp->belong_to_view && check_single_table_access(thd, first_table ? want_access_first : - want_access, leaves_tmp)) + want_access, leaves_tmp, false)) { tables->hide_view_error(thd); return TRUE; --- 1.641/sql/sql_parse.cc 2007-03-12 23:07:37 +04:00 +++ 1.642/sql/sql_parse.cc 2007-03-12 23:07:37 +04:00 @@ -4431,6 +4431,8 @@ static bool execute_sqlcom_select(THD *t thd Thread handler privilege requested privilege all_tables global table list of query + no_errors FALSE/TRUE - report/don't report error to + the client (using my_error() call). RETURN 0 - OK @@ -4438,7 +4440,7 @@ static bool execute_sqlcom_select(THD *t */ bool check_single_table_access(THD *thd, ulong privilege, - TABLE_LIST *all_tables) + TABLE_LIST *all_tables, bool no_errors) { Security_context * backup_ctx= thd->security_ctx; @@ -4454,12 +4456,12 @@ bool check_single_table_access(THD *thd, db_name= all_tables->db; if (check_access(thd, privilege, db_name, - &all_tables->grant.privilege, 0, 0, + &all_tables->grant.privilege, 0, no_errors, test(all_tables->schema_table))) goto deny; /* Show only 1 table for check_grant */ - if (grant_option && check_grant(thd, privilege, all_tables, 0, 1, 0)) + if (grant_option && check_grant(thd, privilege, all_tables, 0, 1, no_errors)) goto deny; thd->security_ctx= backup_ctx; @@ -4487,7 +4489,7 @@ deny: bool check_one_table_access(THD *thd, ulong privilege, TABLE_LIST *all_tables) { - if (check_single_table_access (thd,privilege,all_tables)) + if (check_single_table_access (thd,privilege,all_tables, false)) return 1; /* Check rights on tables of subselects and implictly opened tables */ @@ -4500,7 +4502,7 @@ bool check_one_table_access(THD *thd, ul */ if (view && subselects_tables->belong_to_view == view) { - if (check_single_table_access (thd, privilege, subselects_tables)) + if (check_single_table_access (thd, privilege, subselects_tables, false)) return 1; subselects_tables= subselects_tables->next_global; } --- 1.148/sql/share/errmsg.txt 2007-03-12 23:07:37 +04:00 +++ 1.149/sql/share/errmsg.txt 2007-03-12 23:07:37 +04:00 @@ -5819,6 +5819,8 @@ ER_WRONG_VALUE ER_NO_PARTITION_FOR_GIVEN_VALUE eng "Table has no partition for value %-.64s" ger "Tabelle hat für den Wert %-.64s keine Partition" +ER_NO_PARTITION_FOR_GIVEN_VALUE_SILENT + eng "Table has no partition for some values" ER_FILEGROUP_OPTION_ONLY_ONCE eng "It is not allowed to specify %s more than once" ger "%s darf nicht mehr als einmal angegegeben werden" --- 1.2/mysql-test/r/partition_grant.result 2007-03-12 23:07:37 +04:00 +++ 1.3/mysql-test/r/partition_grant.result 2007-03-12 23:07:37 +04:00 @@ -19,7 +19,16 @@ revoke alter on mysqltest_1.* from mysql alter table t1 drop partition p3; ERROR 42000: ALTER command denied to user 'mysqltest_1'@'localhost' for table 't1' revoke select,alter,drop on mysqltest_1.* from mysqltest_1@localhost; -drop user mysqltest_1@localhost; drop table t1; +create table t1 (s1 int); +insert into t1 values (1); +grant alter on mysqltest_1.* to mysqltest_1@localhost; +alter table t1 partition by list (s1) (partition p1 values in (2)); +ERROR HY000: Table has no partition for some values +grant select, alter on mysqltest_1.* to mysqltest_1@localhost; +alter table t1 partition by list (s1) (partition p1 values in (2)); +ERROR HY000: Table has no partition for value 1 +drop table t1; +drop user mysqltest_1@localhost; drop schema mysqltest_1; End of 5.1 tests --- 1.2/mysql-test/t/partition_grant.test 2007-03-12 23:07:37 +04:00 +++ 1.3/mysql-test/t/partition_grant.test 2007-03-12 23:07:37 +04:00 @@ -50,10 +50,31 @@ alter table t1 drop partition p3; disconnect conn3; connection default; - revoke select,alter,drop on mysqltest_1.* from mysqltest_1@localhost; -drop user mysqltest_1@localhost; drop table t1; + +# +# Bug #23675 Partitions: possible security breach via alter +# + +create table t1 (s1 int); +insert into t1 values (1); +grant alter on mysqltest_1.* to mysqltest_1@localhost; +connect (conn4,localhost,mysqltest_1,,mysqltest_1); +connection conn4; +--error 1514 +alter table t1 partition by list (s1) (partition p1 values in (2)); +connection default; +grant select, alter on mysqltest_1.* to mysqltest_1@localhost; +disconnect conn4; +connect (conn5,localhost,mysqltest_1,,mysqltest_1); +--error 1514 +alter table t1 partition by list (s1) (partition p1 values in (2)); +disconnect conn5; +connection default; +drop table t1; + +drop user mysqltest_1@localhost; drop schema mysqltest_1; --echo End of 5.1 tests --- 1.34/sql/partition_info.cc 2007-03-12 23:07:37 +04:00 +++ 1.35/sql/partition_info.cc 2007-03-12 23:07:37 +04:00 @@ -850,13 +850,24 @@ void partition_info::print_no_partition_ char buf[100]; char *buf_ptr= (char*)&buf; my_bitmap_map *old_map= dbug_tmp_use_all_columns(table, table->read_set); + TABLE_LIST table_list; if (part_expr->null_value) buf_ptr= (char*)"NULL"; else longlong2str(err_value, buf, part_expr->unsigned_flag ? 10 : -10); - my_error(ER_NO_PARTITION_FOR_GIVEN_VALUE, MYF(0), buf_ptr); + + bzero(&table_list, sizeof(table_list)); + table_list.db= table->s->db.str; + table_list.table_name= table->s->table_name.str; + + if (check_single_table_access(current_thd, + SELECT_ACL, &table_list, true)) + my_message(ER_NO_PARTITION_FOR_GIVEN_VALUE, + ER(ER_NO_PARTITION_FOR_GIVEN_VALUE_SILENT), MYF(0)); + else + my_error(ER_NO_PARTITION_FOR_GIVEN_VALUE, MYF(0), buf_ptr); dbug_tmp_restore_column_map(table->read_set, old_map); } /*