MySQL Lists are EOL. Please join:

List:Internals« Previous MessageNext Message »
From:antony Date:August 30 2005 2:54pm
Subject:bk commit into 5.0 tree (acurtis:1.1913) BUG#8884
View as plain text  
Below is the list of changes that have just been committed into a local
5.0 repository of antony. When antony does a push these changes will
be propagated to the main repository and, within 24 hours after the
push, to the public repository.
For information on how to access the public repository
see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html

ChangeSet
  1.1913 05/08/30 15:54:41 acurtis@stripped +7 -0
  Bug#8884
    "Create trigger succeeds even when user does not have UPDATE privilege"
    Add check for specific condition. Tests included.

  sql/sql_yacc.yy
    1.415 05/08/30 15:54:12 acurtis@stripped +1 -0
    we are updating a field, set flag for checking when creating trigger

  sql/sql_trigger.cc
    1.28 05/08/30 15:54:12 acurtis@stripped +0 -8
    privilege check moved to sql_parse.cc

  sql/sql_parse.cc
    1.477 05/08/30 15:54:12 acurtis@stripped +12 -0
    privilege check moved from sql_trigger.cc to here.

  sql/sp_head.h
    1.67 05/08/30 15:54:11 acurtis@stripped +1 -0
    new field m_need_update_priv

  sql/sp_head.cc
    1.177 05/08/30 15:54:11 acurtis@stripped +1 -1
    new field m_need_update_priv

  mysql-test/t/trigger.test
    1.26 05/08/30 15:54:11 acurtis@stripped +21 -0
    test for bug 8884

  mysql-test/r/trigger.result
    1.20 05/08/30 15:54:11 acurtis@stripped +16 -0
    test for bug 8884

# This is a BitKeeper patch.  What follows are the unified diffs for the
# set of deltas contained in the patch.  The rest of the patch, the part
# that BitKeeper cares about, is below these diffs.
# User:	acurtis
# Host:	ltantony.xiphis.org
# Root:	/usr/home/antony/work2/p3-bug8884.2

--- 1.476/sql/sql_parse.cc	2005-08-26 23:33:00 +01:00
+++ 1.477/sql/sql_parse.cc	2005-08-30 15:54:12 +01:00
@@ -4496,6 +4496,16 @@
     }
   case SQLCOM_CREATE_TRIGGER:
   {
+    if (check_global_access(thd, SUPER_ACL) ||
+        lex->sphead->m_need_update_priv &&
+        (check_db_used(thd, all_tables) ||
+         check_one_table_access(thd, UPDATE_ACL, all_tables)))
+    {
+      delete lex->sphead;
+      lex->sphead= 0;
+      goto error;
+    }
+      
     res= mysql_create_or_drop_trigger(thd, all_tables, 1);
 
     /* We don't care about trigger body after this point */
@@ -4505,6 +4515,8 @@
   }
   case SQLCOM_DROP_TRIGGER:
   {
+    if (check_global_access(thd, SUPER_ACL))
+      goto error;
     res= mysql_create_or_drop_trigger(thd, all_tables, 0);
     break;
   }

--- 1.414/sql/sql_yacc.yy	2005-08-29 11:20:33 +01:00
+++ 1.415/sql/sql_yacc.yy	2005-08-30 15:54:12 +01:00
@@ -7879,6 +7879,7 @@
                                     (byte **)&trg_fld->next_trg_field);
 
             lex->sphead->add_instr(sp_fld);
+            lex->sphead->m_need_update_priv= TRUE;
           }
           else if ($2.var)
           { /* System variable */

--- 1.19/mysql-test/r/trigger.result	2005-08-23 06:15:00 +01:00
+++ 1.20/mysql-test/r/trigger.result	2005-08-30 15:54:11 +01:00
@@ -738,3 +738,19 @@
 1
 drop trigger t1_bi;
 drop tables t1, t2;
+create database db1;
+create table db1.t1 (f1 int, f2 int);
+insert into db1.t1 values (1,1),(2,2),(3,3);
+create user dummy@localhost;
+grant select on db1.* to dummy@localhost;
+grant super on *.* to dummy@localhost;
+show grants for dummy@localhost;
+Grants for dummy@localhost
+GRANT SUPER ON *.* TO 'dummy'@'localhost'
+GRANT SELECT ON `db1`.* TO 'dummy'@'localhost'
+use db1;
+create trigger trg1 before insert on t1 for each row set new.f1=999;
+ERROR 42000: UPDATE command denied to user 'dummy'@'localhost' for table 't1'
+drop table db1.t1;
+drop database db1;
+drop user dummy@localhost;

--- 1.25/mysql-test/t/trigger.test	2005-08-23 06:12:24 +01:00
+++ 1.26/mysql-test/t/trigger.test	2005-08-30 15:54:11 +01:00
@@ -765,3 +765,24 @@
 select * from t1;
 drop trigger t1_bi;
 drop tables t1, t2;
+
+#
+# Bug#8884 - Create trigger succeeds even when user does not have UPDATE privilege
+#
+create database db1;
+create table db1.t1 (f1 int, f2 int);
+insert into db1.t1 values (1,1),(2,2),(3,3);
+create user dummy@localhost;
+grant select on db1.* to dummy@localhost;
+grant super on *.* to dummy@localhost;
+connect (user,localhost,dummy,,);
+connection user;
+show grants for dummy@localhost;
+use db1;
+--error 1142
+create trigger trg1 before insert on t1 for each row set new.f1=999;
+connection default;
+disconnect user;
+drop table db1.t1;
+drop database db1;
+drop user dummy@localhost;

--- 1.27/sql/sql_trigger.cc	2005-08-15 16:15:04 +01:00
+++ 1.28/sql/sql_trigger.cc	2005-08-30 15:54:12 +01:00
@@ -123,14 +123,6 @@
     DBUG_RETURN(TRUE);
 
   /*
-    TODO: We should check if user has TRIGGER privilege for table here.
-    Now we just require SUPER privilege for creating/dropping because
-    we don't have proper privilege checking for triggers in place yet.
-  */
-  if (check_global_access(thd, SUPER_ACL))
-    DBUG_RETURN(TRUE);
-
-  /*
     We do not allow creation of triggers on temporary tables. We also don't
     allow creation of triggers on views but fulfilment of this restriction
     is guaranteed by open_ltable(). It is better to have this check here

--- 1.176/sql/sp_head.cc	2005-08-28 17:25:49 +01:00
+++ 1.177/sql/sp_head.cc	2005-08-30 15:54:11 +01:00
@@ -366,7 +366,7 @@
   :Query_arena(&main_mem_root, INITIALIZED_FOR_SP),
    m_returns_cs(NULL), m_has_return(FALSE),
    m_simple_case(FALSE), m_multi_results(FALSE), m_in_handler(FALSE),
-   m_is_invoked(FALSE)
+   m_need_update_priv(FALSE), m_is_invoked(FALSE)
 {
   extern byte *
     sp_table_key(const byte *ptr, uint *plen, my_bool first);

--- 1.66/sql/sp_head.h	2005-08-27 14:13:19 +01:00
+++ 1.67/sql/sp_head.h	2005-08-30 15:54:11 +01:00
@@ -119,6 +119,7 @@
   my_bool m_simple_case;	// TRUE if parsing simple case, FALSE otherwise
   my_bool m_multi_results;	// TRUE if a procedure with SELECT(s)
   my_bool m_in_handler;		// TRUE if parser in a handler body
+  my_bool m_need_update_priv;   // TRUE if trigger and needs UPDATE priv
   uchar *m_tmp_query;		// Temporary pointer to sub query string
   uint m_old_cmq;		// Old CLIENT_MULTI_QUERIES value
   st_sp_chistics *m_chistics;
Thread
bk commit into 5.0 tree (acurtis:1.1913) BUG#8884antony30 Aug