-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
MDEV-7280 DATABASE: CREATE OR REPLACE
A clean-up: require CREATE+DROP privileges for "CREATE OR REPLACE DATABASE", instead of just CREATE privilege.
- Loading branch information
Alexander Barkov
committed
Dec 10, 2014
1 parent
31c7458
commit 92a523e
Showing
3 changed files
with
110 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,40 @@ | ||
# | ||
# Tests for checking permission denied on CREATE OR REPLACE if DROP | ||
# access is revoked | ||
# | ||
# These statements do not need special tests for CREATE OR REPLACE, | ||
# because they do not have separate permissions for create and drop: | ||
# CREATE OR REPLACE EVENT (uses EVENT_ACL for both CREATE and DROP) | ||
# CREATE OR DROP SERVER (uses SUPER_ALC for both CREATE and DROP) | ||
# CREATE OR DROP TRIGGER (uses TRIGGER_ACL for both CREATE and DROP) | ||
SELECT CURRENT_USER; | ||
CURRENT_USER | ||
root@localhost | ||
CREATE DATABASE db1; | ||
GRANT ALL ON db1.* TO mysqltest_1@localhost; | ||
REVOKE DROP ON db1.* FROM mysqltest_1@localhost; | ||
REVOKE ALTER ROUTINE ON db1.* FROM mysqltest_1@localhost; | ||
GRANT DELETE ON mysql.* TO mysqltest_1@localhost; | ||
REVOKE DELETE ON mysql.* FROM mysqltest_1@localhost; | ||
FLUSH PRIVILEGES; | ||
SELECT CURRENT_USER; | ||
CURRENT_USER | ||
mysqltest_1@localhost | ||
CREATE DATABASE db1; | ||
ERROR HY000: Can't create database 'db1'; database exists | ||
CREATE OR REPLACE DATABASE db1; | ||
ERROR 42000: Access denied for user 'mysqltest_1'@'localhost' to database 'db1' | ||
CREATE OR REPLACE DATABASE db2; | ||
ERROR 42000: Access denied for user 'mysqltest_1'@'localhost' to database 'db2' | ||
USE db1; | ||
CREATE OR REPLACE TABLE t1(id INT); | ||
ERROR 42000: DROP command denied to user 'mysqltest_1'@'localhost' for table 't1' | ||
SELECT CURRENT_USER; | ||
CURRENT_USER | ||
root@localhost | ||
REVOKE ALL ON db1.* FROM mysqltest_1@localhost; | ||
DROP DATABASE IF EXISTS db2; | ||
Warnings: | ||
Note 1008 Can't drop database 'db2'; database doesn't exist | ||
DROP DATABASE db1; | ||
DROP USER mysqltest_1@localhost; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,67 @@ | ||
# Grant tests not performed with embedded server | ||
-- source include/not_embedded.inc | ||
|
||
--echo # | ||
--echo # Tests for checking permission denied on CREATE OR REPLACE if DROP | ||
--echo # access is revoked | ||
--echo # | ||
|
||
--echo # These statements do not need special tests for CREATE OR REPLACE, | ||
--echo # because they do not have separate permissions for create and drop: | ||
--echo # CREATE OR REPLACE EVENT (uses EVENT_ACL for both CREATE and DROP) | ||
--echo # CREATE OR DROP SERVER (uses SUPER_ALC for both CREATE and DROP) | ||
--echo # CREATE OR DROP TRIGGER (uses TRIGGER_ACL for both CREATE and DROP) | ||
|
||
SELECT CURRENT_USER; | ||
CREATE DATABASE db1; | ||
GRANT ALL ON db1.* TO mysqltest_1@localhost; | ||
REVOKE DROP ON db1.* FROM mysqltest_1@localhost; | ||
REVOKE ALTER ROUTINE ON db1.* FROM mysqltest_1@localhost; | ||
GRANT DELETE ON mysql.* TO mysqltest_1@localhost; | ||
REVOKE DELETE ON mysql.* FROM mysqltest_1@localhost; | ||
FLUSH PRIVILEGES; | ||
|
||
connect (user_a, localhost, mysqltest_1,,); | ||
connection user_a; | ||
SELECT CURRENT_USER; | ||
|
||
# mysqltest_1 has CREATE privilege on db1 | ||
--error ER_DB_CREATE_EXISTS | ||
CREATE DATABASE db1; | ||
|
||
# mysqltest_1 has no DROP privilege on db1 | ||
--error ER_DBACCESS_DENIED_ERROR | ||
CREATE OR REPLACE DATABASE db1; | ||
|
||
# mysqltest_1 has no any privileges on db2 | ||
--error ER_DBACCESS_DENIED_ERROR | ||
CREATE OR REPLACE DATABASE db2; | ||
|
||
USE db1; | ||
--error ER_TABLEACCESS_DENIED_ERROR | ||
CREATE OR REPLACE TABLE t1(id INT); | ||
|
||
#TODO: add this when "MDEV-5359 CREATE OR REPLACE..." is done | ||
#DELIMITER $; | ||
#--error ER_PROCACCESS_DENIED_ERROR | ||
#CREATE OR REPLACE PROCEDURE proc1 (OUT cnt INT) BEGIN SELECT COUNT(*) INTO cnt FROM t1; END$ | ||
#DELIMITER ;$ | ||
# | ||
#--error ER_DBACCESS_DENIED_ERROR | ||
#CREATE OR REPLACE FUNCTION lookup RETURNS STRING SONAME "udf_example.so"; | ||
# | ||
#--error ER_PROCACCESS_DENIED_ERROR | ||
#CREATE OR REPLACE FUNCTION hello(str char(20)) RETURNS TEXT RETURN CONCAT('Hello, ', str, '!'); | ||
# | ||
#--error ER_SPECIFIC_ACCESS_DENIED_ERROR | ||
#CREATE OR REPLACE USER u1@localhost; | ||
# | ||
#--error ER_SPECIFIC_ACCESS_DENIED_ERROR | ||
#CREATE OR REPLACE ROLE developer; | ||
|
||
connection default; | ||
SELECT CURRENT_USER; | ||
REVOKE ALL ON db1.* FROM mysqltest_1@localhost; | ||
DROP DATABASE IF EXISTS db2; | ||
DROP DATABASE db1; | ||
DROP USER mysqltest_1@localhost; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters