Skip to content

Commit 1fe9092

Browse files
montywimontywi
committed
Fix privilege checking for sequence
MDEV-13732 User with SELECT privilege can ALTER sequence
1 parent dc09f8f commit 1fe9092

File tree

3 files changed

+124
-1
lines changed

3 files changed

+124
-1
lines changed

‎mysql-test/suite/sql_sequence/grant.result

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
SET @@SQL_MODE = REPLACE(@@SQL_MODE, 'NO_AUTO_CREATE_USER', '');
2+
create database mysqltest_1;
3+
use mysqltest_1;
4+
grant all on mysqltest_1.* to 'normal'@'%';
5+
grant select on mysqltest_1.* to 'read_only'@'%';
6+
grant select,insert on mysqltest_1.* to 'read_write'@'%';
7+
grant select,insert,alter on mysqltest_1.* to 'alter'@'%';
8+
grant alter on mysqltest_1.* to only_alter@'%';
9+
connect normal,localhost,normal,,mysqltest_1;
10+
connect read_only,localhost,read_only,,mysqltest_1;
11+
connect read_write,localhost,read_write,,mysqltest_1;
12+
connect alter,localhost,alter,,mysqltest_1;
13+
connect only_alter, localhost, only_alter,,mysqltest_1;
14+
connection normal;
15+
create sequence s1;
16+
select next value for s1;
17+
next value for s1
18+
1
19+
alter sequence s1 restart= 11;
20+
select * from s1;
21+
next_not_cached_value minimum_value maximum_value start_value increment cache_size cycle_option cycle_count
22+
11 1 9223372036854775806 1 1 1000 0 0
23+
connection read_only;
24+
select next value for s1;
25+
ERROR 42000: INSERT command denied to user 'read_only'@'localhost' for table 's1'
26+
alter sequence s1 restart= 11;
27+
ERROR 42000: ALTER command denied to user 'read_only'@'localhost' for table 's1'
28+
select * from s1;
29+
next_not_cached_value minimum_value maximum_value start_value increment cache_size cycle_option cycle_count
30+
11 1 9223372036854775806 1 1 1000 0 0
31+
connection read_write;
32+
select next value for s1;
33+
next value for s1
34+
11
35+
alter sequence s1 restart= 11;
36+
ERROR 42000: ALTER command denied to user 'read_write'@'localhost' for table 's1'
37+
select * from s1;
38+
next_not_cached_value minimum_value maximum_value start_value increment cache_size cycle_option cycle_count
39+
1011 1 9223372036854775806 1 1 1000 0 0
40+
connection alter;
41+
select next value for s1;
42+
next value for s1
43+
12
44+
alter sequence s1 restart= 11;
45+
select * from s1;
46+
next_not_cached_value minimum_value maximum_value start_value increment cache_size cycle_option cycle_count
47+
11 1 9223372036854775806 1 1 1000 0 0
48+
connection only_alter;
49+
select next value for s1;
50+
ERROR 42000: INSERT command denied to user 'only_alter'@'localhost' for table 's1'
51+
alter sequence s1 restart= 11;
52+
select * from s1;
53+
ERROR 42000: SELECT command denied to user 'only_alter'@'localhost' for table 's1'
54+
connection default;
55+
drop database mysqltest_1;
56+
drop user 'normal'@'%';
57+
drop user 'read_only'@'%';
58+
drop user 'read_write'@'%';
59+
drop user 'alter'@'%';
60+
drop user 'only_alter'@'%';

‎mysql-test/suite/sql_sequence/grant.test

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#
2+
# Test some grants with sequences
3+
# Note that replication.test also does some grant testing
4+
#
5+
6+
SET @@SQL_MODE = REPLACE(@@SQL_MODE, 'NO_AUTO_CREATE_USER', '');
7+
create database mysqltest_1;
8+
use mysqltest_1;
9+
grant all on mysqltest_1.* to 'normal'@'%';
10+
grant select on mysqltest_1.* to 'read_only'@'%';
11+
grant select,insert on mysqltest_1.* to 'read_write'@'%';
12+
grant select,insert,alter on mysqltest_1.* to 'alter'@'%';
13+
grant alter on mysqltest_1.* to only_alter@'%';
14+
15+
connect(normal,localhost,normal,,mysqltest_1);
16+
connect(read_only,localhost,read_only,,mysqltest_1);
17+
connect(read_write,localhost,read_write,,mysqltest_1);
18+
connect(alter,localhost,alter,,mysqltest_1);
19+
connect(only_alter, localhost, only_alter,,mysqltest_1);
20+
21+
connection normal;
22+
create sequence s1;
23+
select next value for s1;
24+
alter sequence s1 restart= 11;
25+
select * from s1;
26+
27+
connection read_only;
28+
--error ER_TABLEACCESS_DENIED_ERROR
29+
select next value for s1;
30+
--error ER_TABLEACCESS_DENIED_ERROR
31+
alter sequence s1 restart= 11;
32+
select * from s1;
33+
34+
connection read_write;
35+
select next value for s1;
36+
--error ER_TABLEACCESS_DENIED_ERROR
37+
alter sequence s1 restart= 11;
38+
select * from s1;
39+
40+
connection alter;
41+
select next value for s1;
42+
alter sequence s1 restart= 11;
43+
select * from s1;
44+
45+
connection only_alter;
46+
--error ER_TABLEACCESS_DENIED_ERROR
47+
select next value for s1;
48+
alter sequence s1 restart= 11;
49+
--error ER_TABLEACCESS_DENIED_ERROR
50+
select * from s1;
51+
52+
#
53+
# Cleanup
54+
#
55+
56+
connection default;
57+
drop database mysqltest_1;
58+
drop user 'normal'@'%';
59+
drop user 'read_only'@'%';
60+
drop user 'read_write'@'%';
61+
drop user 'alter'@'%';
62+
drop user 'only_alter'@'%';
63+

‎sql/sql_acl.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7603,7 +7603,7 @@ bool check_grant(THD *thd, ulong want_access, TABLE_LIST *tables,
76037603
sctx= t_ref->security_ctx ? t_ref->security_ctx : thd->security_ctx;
76047604
ulong orig_want_access= original_want_access;
76057605

7606-
if (t_ref->sequence)
7606+
if (t_ref->sequence && !(want_access & ~(INSERT_ACL | SELECT_ACL)))
76077607
{
76087608
/* We want to have either SELECT or INSERT rights to sequences depending
76097609
on how they are accessed

0 commit comments

Comments
 (0)