Skip to content

Commit d72eeba

Browse files
dr-mdr-m
committed
Merge 10.1 into 10.2
2 parents 4832b75 + 4985481 commit d72eeba

14 files changed

+486
-308
lines changed

‎mysql-test/suite/roles/set_default_role_for.result

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ set default role role_a for user_a@localhost;
1414
set default role invalid_role for user_a@localhost;
1515
ERROR OP000: Invalid role specification `invalid_role`
1616
set default role role_b for user_a@localhost;
17-
ERROR OP000: Invalid role specification `role_b`
17+
ERROR OP000: User `user_a@localhost` has not been granted role `role_b`
1818
set default role role_b for user_b@localhost;
1919
show grants;
2020
Grants for user_a@localhost
@@ -36,7 +36,7 @@ user host default_role
3636
user_a localhost role_a
3737
user_b localhost role_b
3838
set default role role_b for current_user;
39-
ERROR OP000: Invalid role specification `role_b`
39+
ERROR OP000: User `user_a@localhost` has not been granted role `role_b`
4040
show grants;
4141
Grants for user_b@localhost
4242
GRANT role_b TO 'user_b'@'localhost'

‎mysql-test/suite/roles/set_default_role_invalid.result

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,90 @@ ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'us
3838
drop role test_role;
3939
drop role not_granted_role;
4040
drop user test_user@localhost;
41+
#
42+
# MDEV-22312: Bad error message for SET DEFAULT ROLE when user account
43+
# is not granted the role
44+
#
45+
CREATE USER a;
46+
CREATE USER b;
47+
CREATE ROLE r1;
48+
CREATE ROLE r2;
49+
SET DEFAULT ROLE r1 FOR a;
50+
ERROR OP000: User `a@%` has not been granted role `r1`
51+
GRANT r1 TO b;
52+
GRANT r2 TO b;
53+
SET DEFAULT ROLE r1 FOR b;
54+
# Change user b
55+
SELECT CURRENT_ROLE;
56+
CURRENT_ROLE
57+
r1
58+
SET ROLE r2;
59+
SELECT CURRENT_ROLE;
60+
CURRENT_ROLE
61+
r2
62+
SET DEFAULT ROLE r1 FOR a;
63+
ERROR 42000: Access denied for user 'b'@'%' to database 'mysql'
64+
SET DEFAULT ROLE r2;
65+
# Change user root (session 1: select_priv to b)
66+
GRANT SELECT ON mysql.* TO b;
67+
# Change user b (session 1: select_priv)
68+
SHOW GRANTS FOR b;
69+
Grants for b@%
70+
GRANT r1 TO 'b'@'%'
71+
GRANT r2 TO 'b'@'%'
72+
GRANT USAGE ON *.* TO 'b'@'%'
73+
GRANT SELECT ON `mysql`.* TO 'b'@'%'
74+
SET DEFAULT ROLE r1 FOR a;
75+
ERROR 42000: Access denied for user 'b'@'%' to database 'mysql'
76+
SELECT CURRENT_ROLE;
77+
CURRENT_ROLE
78+
r2
79+
SET DEFAULT ROLE NONE;
80+
SELECT CURRENT_ROLE;
81+
CURRENT_ROLE
82+
r2
83+
SET DEFAULT ROLE current_role FOR current_user;
84+
SET DEFAULT ROLE invalid_role;
85+
ERROR OP000: Invalid role specification `invalid_role`
86+
SET DEFAULT ROLE invalid_role FOR a;
87+
ERROR 42000: Access denied for user 'b'@'%' to database 'mysql'
88+
SET DEFAULT ROLE none FOR a;
89+
ERROR 42000: Access denied for user 'b'@'%' to database 'mysql'
90+
# Change user root (session 2: adding update_priv to user b)
91+
GRANT UPDATE ON mysql.* TO b;
92+
# Change user b
93+
SHOW GRANTS FOR b;
94+
Grants for b@%
95+
GRANT r1 TO 'b'@'%'
96+
GRANT r2 TO 'b'@'%'
97+
GRANT USAGE ON *.* TO 'b'@'%'
98+
GRANT SELECT, UPDATE ON `mysql`.* TO 'b'@'%'
99+
SET DEFAULT ROLE r1 FOR a;
100+
ERROR OP000: User `a@%` has not been granted role `r1`
101+
SET DEFAULT ROLE invalid_role;
102+
ERROR OP000: Invalid role specification `invalid_role`
103+
SET DEFAULT ROLE invalid_role FOR a;
104+
ERROR OP000: Invalid role specification `invalid_role`
105+
SET DEFAULT ROLE none FOR a;
106+
# Change user root (session 3: Grant role to user a)
107+
GRANT r1 TO a;
108+
SET DEFAULT ROLE r1 FOR a;
109+
# Change user a (verify session 3)
110+
SELECT CURRENT_ROLE;
111+
CURRENT_ROLE
112+
r1
113+
SET DEFAULT ROLE None;
114+
# Change user b (session 3: role granted to user a)
115+
SET DEFAULT ROLE r1 FOR a;
116+
SET DEFAULT ROLE r2 FOR a;
117+
ERROR OP000: User `a@%` has not been granted role `r2`
118+
SET DEFAULT ROLE invalid_role;
119+
ERROR OP000: Invalid role specification `invalid_role`
120+
SET DEFAULT ROLE invalid_role FOR a;
121+
ERROR OP000: Invalid role specification `invalid_role`
122+
SELECT user, host, default_role FROM mysql.user where user='a' or user='b';
123+
user host default_role
124+
a % r1
125+
b % r2
126+
DROP ROLE r1, r2;
127+
DROP USER a, b;

‎mysql-test/suite/roles/set_default_role_invalid.test

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,3 +60,110 @@ change_user 'root';
6060
drop role test_role;
6161
drop role not_granted_role;
6262
drop user test_user@localhost;
63+
64+
--echo #
65+
--echo # MDEV-22312: Bad error message for SET DEFAULT ROLE when user account
66+
--echo # is not granted the role
67+
--echo #
68+
69+
CREATE USER a;
70+
CREATE USER b;
71+
CREATE ROLE r1;
72+
CREATE ROLE r2;
73+
# Role has not been granted to user a, but the role is visible to current_user
74+
--error ER_INVALID_ROLE
75+
SET DEFAULT ROLE r1 FOR a;
76+
# Granting roles to user b
77+
GRANT r1 TO b;
78+
GRANT r2 TO b;
79+
# After granting the role, role can be set as default
80+
SET DEFAULT ROLE r1 FOR b;
81+
82+
--echo # Change user b
83+
change_user b;
84+
SELECT CURRENT_ROLE;
85+
SET ROLE r2;
86+
SELECT CURRENT_ROLE;
87+
# User b has no UPDATE_PRIV for mysql.user
88+
--error ER_DBACCESS_DENIED_ERROR
89+
SET DEFAULT ROLE r1 FOR a;
90+
SET DEFAULT ROLE r2;
91+
92+
--echo # Change user root (session 1: select_priv to b)
93+
change_user root;
94+
# Let's grant select_priv to user b
95+
GRANT SELECT ON mysql.* TO b;
96+
97+
--echo # Change user b (session 1: select_priv)
98+
change_user b;
99+
SHOW GRANTS FOR b;
100+
# User must have update_priv before setting the role
101+
--error ER_DBACCESS_DENIED_ERROR
102+
SET DEFAULT ROLE r1 FOR a;
103+
# Testing the `CURRENT_ROLE` as a special case
104+
SELECT CURRENT_ROLE;
105+
SET DEFAULT ROLE NONE;
106+
SELECT CURRENT_ROLE;
107+
SET DEFAULT ROLE current_role FOR current_user;
108+
# Testing of non-existing role
109+
--error ER_INVALID_ROLE
110+
SET DEFAULT ROLE invalid_role;
111+
# Testing of non-existing role for different user
112+
--error ER_DBACCESS_DENIED_ERROR
113+
SET DEFAULT ROLE invalid_role FOR a;
114+
# Testing the `None` role for different user
115+
-- error ER_DBACCESS_DENIED_ERROR
116+
SET DEFAULT ROLE none FOR a;
117+
118+
--echo # Change user root (session 2: adding update_priv to user b)
119+
change_user root;
120+
# update_priv are enough
121+
GRANT UPDATE ON mysql.* TO b;
122+
123+
--echo # Change user b
124+
change_user b;
125+
SHOW GRANTS FOR b;
126+
# In all tests in session user a has not been granted the role
127+
# Testing setting role for different user, should fail with new error
128+
--error ER_INVALID_ROLE
129+
SET DEFAULT ROLE r1 FOR a;
130+
# Testing of non-existing role
131+
--error ER_INVALID_ROLE
132+
SET DEFAULT ROLE invalid_role;
133+
# Testing of non-existing role for different user with update_priv
134+
--error ER_INVALID_ROLE
135+
SET DEFAULT ROLE invalid_role FOR a;
136+
# Testing the `None` role for different user with update_priv
137+
SET DEFAULT ROLE none FOR a;
138+
139+
--echo # Change user root (session 3: Grant role to user a)
140+
change_user root;
141+
# After granting the privilege for a, user b can set default role
142+
GRANT r1 TO a;
143+
SET DEFAULT ROLE r1 FOR a;
144+
145+
--echo # Change user a (verify session 3)
146+
change_user a;
147+
SELECT CURRENT_ROLE;
148+
SET DEFAULT ROLE None;
149+
150+
--echo # Change user b (session 3: role granted to user a)
151+
change_user b;
152+
# This should set role because b has update_priv
153+
SET DEFAULT ROLE r1 FOR a;
154+
# Testing non-granted role r2 still should fail
155+
-- error ER_INVALID_ROLE
156+
SET DEFAULT ROLE r2 FOR a;
157+
# Testing of non-existing role
158+
--error ER_INVALID_ROLE
159+
SET DEFAULT ROLE invalid_role;
160+
# Testing of non-existing role for different user
161+
--error ER_INVALID_ROLE
162+
SET DEFAULT ROLE invalid_role FOR a;
163+
164+
# Clear the workspace
165+
change_user root;
166+
--sorted_result
167+
SELECT user, host, default_role FROM mysql.user where user='a' or user='b';
168+
DROP ROLE r1, r2;
169+
DROP USER a, b;

‎mysql-test/suite/roles/set_role-recursive.result

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ Grants for test_user@localhost
6666
GRANT USAGE ON *.* TO 'test_user'@'localhost'
6767
GRANT test_role1 TO 'test_user'@'localhost'
6868
set role test_role2;
69-
ERROR OP000: Invalid role specification `test_role2`
69+
ERROR OP000: User `test_user@localhost` has not been granted role `test_role2`
7070
select current_user(), current_role();
7171
current_user() current_role()
7272
test_user@localhost NULL

‎sql/item_xmlfunc.cc

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -815,7 +815,6 @@ String *Item_nodeset_func_attributebyname::val_nodeset(String *nodeset)
815815
String *Item_nodeset_func_predicate::val_nodeset(String *str)
816816
{
817817
Item_nodeset_func *nodeset_func= (Item_nodeset_func*) args[0];
818-
Item_func *comp_func= (Item_func*)args[1];
819818
uint pos= 0, size;
820819
prepare(str);
821820
size= (uint)(fltend - fltbeg);
@@ -825,7 +824,7 @@ String *Item_nodeset_func_predicate::val_nodeset(String *str)
825824
((XPathFilter*)(&nodeset_func->context_cache))->append_element(flt->num,
826825
flt->pos,
827826
size);
828-
if (comp_func->val_int())
827+
if (args[1]->val_int())
829828
((XPathFilter*)str)->append_element(flt->num, pos++);
830829
}
831830
return str;

‎sql/set_var.cc

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -971,8 +971,17 @@ int set_var_default_role::check(THD *thd)
971971
{
972972
#ifndef NO_EMBEDDED_ACCESS_CHECKS
973973
real_user= get_current_user(thd, user);
974-
int status= acl_check_set_default_role(thd, real_user->host.str, real_user->user.str);
975-
return status;
974+
real_role= role.str;
975+
if (role.str == current_role.str)
976+
{
977+
if (!thd->security_ctx->priv_role[0])
978+
real_role= "NONE";
979+
else
980+
real_role= thd->security_ctx->priv_role;
981+
}
982+
983+
return acl_check_set_default_role(thd, real_user->host.str,
984+
real_user->user.str, real_role);
976985
#else
977986
return 0;
978987
#endif
@@ -983,7 +992,8 @@ int set_var_default_role::update(THD *thd)
983992
#ifndef NO_EMBEDDED_ACCESS_CHECKS
984993
Reprepare_observer *save_reprepare_observer= thd->m_reprepare_observer;
985994
thd->m_reprepare_observer= 0;
986-
int res= acl_set_default_role(thd, real_user->host.str, real_user->user.str, role.str);
995+
int res= acl_set_default_role(thd, real_user->host.str, real_user->user.str,
996+
real_role);
987997
thd->m_reprepare_observer= save_reprepare_observer;
988998
return res;
989999
#else

‎sql/set_var.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -350,6 +350,7 @@ class set_var_default_role: public set_var_base
350350
{
351351
LEX_USER *user, *real_user;
352352
LEX_STRING role;
353+
const char *real_role;
353354
public:
354355
set_var_default_role(LEX_USER *user_arg, LEX_STRING role_arg) :
355356
user(user_arg), role(role_arg) {}

0 commit comments

Comments
 (0)