Skip to content

Commit 34da3be

Browse files
cvicentiucvicentiu
committed
MDEV-10463: Granted as a whole to roles, databases are not show in SHOW DATABASES
The problem lies in not checking role privileges as well during SHOW DATABASES command. This problem is also apparent for SHOW CREATE DATABASE command. Other SHOW COMMANDS make use of check_access, which in turn makes use of acl_get for both priv_user and priv_role parts, which allows them to function correctly.
1 parent 2579b25 commit 34da3be

File tree

3 files changed

+131
-4
lines changed

3 files changed

+131
-4
lines changed

‎mysql-test/suite/roles/show_create_database-10463.result

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
drop database if exists db;
2+
Warnings:
3+
Note 1008 Can't drop database 'db'; database doesn't exist
4+
create role r1;
5+
create user beep@'%';
6+
create database db;
7+
create table db.t1 (i int);
8+
create table db.t2 (b int);
9+
grant select on db.* to r1;
10+
grant r1 to beep@'%';
11+
show databases;
12+
Database
13+
information_schema
14+
test
15+
show create database db;
16+
ERROR 42000: Access denied for user 'beep'@'localhost' to database 'db'
17+
select table_schema, table_name from information_schema.tables
18+
where table_schema = 'db';
19+
table_schema table_name
20+
set role r1;
21+
show databases;
22+
Database
23+
db
24+
information_schema
25+
test
26+
show create database db;
27+
Database Create Database
28+
db CREATE DATABASE `db` /*!40100 DEFAULT CHARACTER SET latin1 */
29+
select table_schema, table_name from information_schema.tables
30+
where table_schema = 'db';
31+
table_schema table_name
32+
db t1
33+
db t2
34+
create role r2;
35+
create user beep2@'%';
36+
grant update on db.* to r2;
37+
grant r2 to beep2;
38+
show databases;
39+
Database
40+
information_schema
41+
test
42+
show create database db;
43+
ERROR 42000: Access denied for user 'beep2'@'localhost' to database 'db'
44+
select table_schema, table_name from information_schema.tables
45+
where table_schema = 'db';
46+
table_schema table_name
47+
set role r2;
48+
show databases;
49+
Database
50+
db
51+
information_schema
52+
test
53+
show create database db;
54+
Database Create Database
55+
db CREATE DATABASE `db` /*!40100 DEFAULT CHARACTER SET latin1 */
56+
select table_schema, table_name from information_schema.tables
57+
where table_schema = 'db';
58+
table_schema table_name
59+
db t1
60+
db t2
61+
drop database db;
62+
drop role r1;
63+
drop user beep;
64+
drop role r2;
65+
drop user beep2;

‎mysql-test/suite/roles/show_create_database-10463.test

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
source include/not_embedded.inc;
2+
3+
drop database if exists db;
4+
5+
create role r1;
6+
create user beep@'%';
7+
8+
create database db;
9+
create table db.t1 (i int);
10+
create table db.t2 (b int);
11+
grant select on db.* to r1;
12+
grant r1 to beep@'%';
13+
14+
--connect (con1,localhost,beep,,)
15+
show databases;
16+
--error ER_DBACCESS_DENIED_ERROR
17+
show create database db;
18+
select table_schema, table_name from information_schema.tables
19+
where table_schema = 'db';
20+
21+
set role r1;
22+
show databases;
23+
show create database db;
24+
select table_schema, table_name from information_schema.tables
25+
where table_schema = 'db';
26+
27+
28+
connection default;
29+
create role r2;
30+
create user beep2@'%';
31+
32+
grant update on db.* to r2;
33+
grant r2 to beep2;
34+
--connect (con2,localhost,beep2,,)
35+
show databases;
36+
--error ER_DBACCESS_DENIED_ERROR
37+
show create database db;
38+
select table_schema, table_name from information_schema.tables
39+
where table_schema = 'db';
40+
41+
set role r2;
42+
show databases;
43+
44+
show create database db;
45+
select table_schema, table_name from information_schema.tables
46+
where table_schema = 'db';
47+
48+
49+
connection default;
50+
51+
drop database db;
52+
drop role r1;
53+
drop user beep;
54+
drop role r2;
55+
drop user beep2;

‎sql/sql_show.cc

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1167,8 +1167,13 @@ bool mysqld_show_create_db(THD *thd, LEX_STRING *dbname,
11671167
if (test_all_bits(sctx->master_access, DB_ACLS))
11681168
db_access=DB_ACLS;
11691169
else
1170-
db_access= (acl_get(sctx->host, sctx->ip, sctx->priv_user, dbname->str, 0) |
1171-
sctx->master_access);
1170+
{
1171+
db_access= acl_get(sctx->host, sctx->ip, sctx->priv_user, dbname->str, 0) |
1172+
sctx->master_access;
1173+
if (sctx->priv_role[0])
1174+
db_access|= acl_get("", "", sctx->priv_role, dbname->str, 0);
1175+
}
1176+
11721177
if (!(db_access & DB_ACLS) && check_grant_db(thd,dbname->str))
11731178
{
11741179
status_var_increment(thd->status_var.access_denied_errors);
@@ -5118,8 +5123,10 @@ int fill_schema_schemata(THD *thd, TABLE_LIST *tables, COND *cond)
51185123
}
51195124
#ifndef NO_EMBEDDED_ACCESS_CHECKS
51205125
if (sctx->master_access & (DB_ACLS | SHOW_DB_ACL) ||
5121-
acl_get(sctx->host, sctx->ip, sctx->priv_user, db_name->str, 0) ||
5122-
!check_grant_db(thd, db_name->str))
5126+
acl_get(sctx->host, sctx->ip, sctx->priv_user, db_name->str, false) ||
5127+
(sctx->priv_role[0] ?
5128+
acl_get("", "", sctx->priv_role, db_name->str, false) : 0) ||
5129+
!check_grant_db(thd, db_name->str))
51235130
#endif
51245131
{
51255132
load_db_opt_by_name(thd, db_name->str, &create);

0 commit comments

Comments
 (0)