kpettersson@stripped wrote:
>
> ChangeSet@stripped, 2007-10-24 10:29:24+02:00, thek@adventure.(none) +1 -0
> Bug #16470 crash on grant if old grant tables
>
> If a user upgraded the server without running mysql_upgrade, and later tried
> to run a GRANT command on grant tables like tables_priv, the server would
> crash.
>
> This patch fixes this problem by checking if the grant tables were properly
> initialized before attempt to store any new grants.
>
> sql/sql_acl.cc@stripped, 2007-10-24 10:29:21+02:00, thek@adventure.(none) +3 -6
> If grant_reload fails, don't try to store new GRANTs because the grant tables
> weren't properly initialized.
>
> diff -Nrup a/sql/sql_acl.cc b/sql/sql_acl.cc
> --- a/sql/sql_acl.cc 2007-06-20 14:24:27 +02:00
> +++ b/sql/sql_acl.cc 2007-10-24 10:29:21 +02:00
> @@ -2780,7 +2780,7 @@ bool mysql_table_grant(THD *thd, TABLE_L
> "--skip-grant-tables"); /* purecov: inspected */
> DBUG_RETURN(TRUE); /* purecov: inspected */
> }
> - if (rights & ~TABLE_ACLS)
> + if ((rights & ~TABLE_ACLS) || !grant_option)
> {
> my_message(ER_ILLEGAL_GRANT_FOR_TABLE, ER(ER_ILLEGAL_GRANT_FOR_TABLE),
> MYF(0));
Hum.. this error doesn't clearly tell what's wrong. I tend to think that
this issue is much wider. We don't have a mechanism to warn the user
that a internal mysql table (be it mysql.*_priv, .events or .proc) needs
to be upgraded. Also, what are the security implications starting a
server with no table access checks and no warning about it?
--
Davi Arnaut, Software Engineer
MySQL Inc, www.mysql.com
Are you MySQL certified? www.mysql.com/certification
