Skip to content

Commit ee77375

Browse files
an3lan3l
committed
MDEV-26875: Wrong user in SET DEFAULT ROLE error
- Regression introduced in 957cb7b - Patch 4abb821 change `mysql.user` to `mysql.global_priv` for `add_anonymous.inc`, update `delete_anonymous.inc`. - Added test case with `--skip-name-resolve` - Add test case with anonymous user - Disable this test for windows, assignes current user to anonymous user. Reviewed by: <serg@mariadb.com>
1 parent b5e43a1 commit ee77375

8 files changed

+181
-10
lines changed

‎mysql-test/include/delete_anonymous_users.inc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Remove anonymous users added by add_anonymous_users.inc
22
disable_warnings;
33
disable_query_log;
4-
DELETE FROM mysql.user where host='localhost' and user='';
4+
DELETE FROM mysql.global_priv where host='localhost' and user='';
55
FLUSH PRIVILEGES;
66
enable_query_log;
77
enable_warnings;

‎mysql-test/suite/roles/set_default_role_for.result

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ set default role role_a for user_a@localhost;
1414
set default role invalid_role for user_a@localhost;
1515
ERROR OP000: Invalid role specification `invalid_role`
1616
set default role role_b for user_a@localhost;
17-
ERROR OP000: User `root`@`localhost` has not been granted role `role_b`
17+
ERROR OP000: User `user_a`@`localhost` has not been granted role `role_b`
1818
set default role role_b for user_b@localhost;
1919
show grants;
2020
Grants for user_a@localhost

‎mysql-test/suite/roles/set_default_role_invalid.result

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ CREATE USER b;
4848
CREATE ROLE r1;
4949
CREATE ROLE r2;
5050
SET DEFAULT ROLE r1 FOR a;
51-
ERROR OP000: User `root`@`localhost` has not been granted role `r1`
51+
ERROR OP000: User `a`@`%` has not been granted role `r1`
5252
GRANT r1 TO b;
5353
GRANT r2 TO b;
5454
SET DEFAULT ROLE r1 FOR b;
@@ -100,7 +100,7 @@ GRANT USAGE ON *.* TO `b`@`%`
100100
GRANT SELECT, UPDATE ON `mysql`.* TO `b`@`%`
101101
SET DEFAULT ROLE `r2` FOR `b`@`%`
102102
SET DEFAULT ROLE r1 FOR a;
103-
ERROR OP000: User `b`@`%` has not been granted role `r1`
103+
ERROR OP000: User `a`@`%` has not been granted role `r1`
104104
SET DEFAULT ROLE invalid_role;
105105
ERROR OP000: Invalid role specification `invalid_role`
106106
SET DEFAULT ROLE invalid_role FOR a;
@@ -117,7 +117,7 @@ SET DEFAULT ROLE None;
117117
# Change user b (session 3: role granted to user a)
118118
SET DEFAULT ROLE r1 FOR a;
119119
SET DEFAULT ROLE r2 FOR a;
120-
ERROR OP000: User `b`@`%` has not been granted role `r2`
120+
ERROR OP000: User `a`@`%` has not been granted role `r2`
121121
SET DEFAULT ROLE invalid_role;
122122
ERROR OP000: Invalid role specification `invalid_role`
123123
SET DEFAULT ROLE invalid_role FOR a;

‎mysql-test/suite/roles/set_default_role_invalid.test

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,6 @@ CREATE USER a;
7070
CREATE USER b;
7171
CREATE ROLE r1;
7272
CREATE ROLE r2;
73-
# Role has not been granted to user a, but the role is visible to current_user
7473
--error ER_INVALID_ROLE
7574
SET DEFAULT ROLE r1 FOR a;
7675
# Granting roles to user b

‎mysql-test/suite/roles/set_default_role_invalid_skip_name_resolve-master.opt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
--skip-name-resolve

‎mysql-test/suite/roles/set_default_role_invalid_skip_name_resolve.result

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
#
2+
# MDEV-26875: Wrong user in SET DEFAULT ROLE error
3+
#
4+
create user test_user;
5+
create role test_role;
6+
show grants for test_user;
7+
Grants for test_user@%
8+
GRANT USAGE ON *.* TO `test_user`@`%`
9+
set default role test_role for test_user;
10+
ERROR OP000: User `test_user`@`%` has not been granted role `test_role`
11+
grant test_role to test_user;
12+
set default role test_role for test_user;
13+
show grants for test_user;
14+
Grants for test_user@%
15+
GRANT `test_role` TO `test_user`@`%`
16+
GRANT USAGE ON *.* TO `test_user`@`%`
17+
SET DEFAULT ROLE `test_role` FOR `test_user`@`%`
18+
set default role none for test_user;
19+
#
20+
# Try to set default role to role(`test_role`).
21+
--------------------------------------------------------------
22+
show grants for test_role;
23+
Grants for test_role
24+
GRANT USAGE ON *.* TO `test_role`
25+
create role new_role;
26+
grant new_role to test_role;
27+
show grants for test_role;
28+
Grants for test_role
29+
GRANT `new_role` TO `test_role`
30+
GRANT USAGE ON *.* TO `test_role`
31+
GRANT USAGE ON *.* TO `new_role`
32+
set default role new_role for test_role;
33+
ERROR OP000: User `test_role`@`%` has not been granted role `new_role`
34+
#
35+
# Test of errors, where hostname cannot be resolved `test_user`
36+
--------------------------------------------------------------
37+
grant test_role to test_user@'%';
38+
set default role test_role for test_user@'%';
39+
connect con_test_user,127.0.0.1,test_user,,,$MASTER_MYPORT;
40+
show grants;
41+
Grants for test_user@%
42+
GRANT `test_role` TO `test_user`@`%`
43+
GRANT USAGE ON *.* TO `test_user`@`%`
44+
GRANT `new_role` TO `test_role`
45+
GRANT USAGE ON *.* TO `test_role`
46+
GRANT USAGE ON *.* TO `new_role`
47+
SET DEFAULT ROLE `test_role` FOR `test_user`@`%`
48+
select current_role;
49+
current_role
50+
test_role
51+
set role `new_role`;
52+
ERROR OP000: User `test_user`@`%` has not been granted role `new_role`
53+
connection default;
54+
set default role none for test_user;
55+
disconnect con_test_user;
56+
connect con_test_user,127.0.0.1,test_user,,,$MASTER_MYPORT;
57+
select current_role;
58+
current_role
59+
NULL
60+
set role `new_role`;
61+
ERROR OP000: User `test_user`@`%` has not been granted role `new_role`
62+
connection default;
63+
disconnect con_test_user;
64+
#
65+
# Test of anonymous user connection
66+
--------------------------------------------------------------
67+
grant test_role to ''@localhost;
68+
connect con1,localhost,'',,,$MASTER_MYPORT;
69+
SELECT CURRENT_ROLE;
70+
CURRENT_ROLE
71+
NULL
72+
SET role test_role;
73+
SELECT CURRENT_ROLE;
74+
CURRENT_ROLE
75+
test_role
76+
SET role new_role;
77+
ERROR OP000: User ``@`localhost` has not been granted role `new_role`
78+
set default role test_role for ''@localhost;
79+
ERROR 42000: You are using MariaDB as an anonymous user and anonymous users are not allowed to modify user settings
80+
connection default;
81+
disconnect con1;
82+
REVOKE all privileges, grant option from ''@localhost;
83+
drop role new_role;
84+
drop role test_role;
85+
drop user test_user;

‎mysql-test/suite/roles/set_default_role_invalid_skip_name_resolve.test

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
source include/not_embedded.inc;
2+
3+
--echo #
4+
--echo # MDEV-26875: Wrong user in SET DEFAULT ROLE error
5+
--echo #
6+
create user test_user;
7+
create role test_role;
8+
show grants for test_user;
9+
--error ER_INVALID_ROLE
10+
set default role test_role for test_user;
11+
grant test_role to test_user;
12+
set default role test_role for test_user;
13+
show grants for test_user;
14+
set default role none for test_user;
15+
16+
--echo #
17+
--echo # Try to set default role to role(`test_role`).
18+
--echo --------------------------------------------------------------
19+
show grants for test_role;
20+
create role new_role;
21+
grant new_role to test_role;
22+
show grants for test_role;
23+
# One can not set role to a role
24+
--error ER_INVALID_ROLE
25+
set default role new_role for test_role;
26+
27+
--echo #
28+
--echo # Test of errors, where hostname cannot be resolved `test_user`
29+
--echo --------------------------------------------------------------
30+
# `new_role` is granted to `test_role`
31+
grant test_role to test_user@'%';
32+
set default role test_role for test_user@'%';
33+
34+
connect con_test_user,127.0.0.1,test_user,,,$MASTER_MYPORT;
35+
show grants;
36+
select current_role;
37+
# `test_user` indirectly granted `new_role`
38+
--error ER_INVALID_ROLE
39+
set role `new_role`;
40+
41+
connection default;
42+
set default role none for test_user;
43+
disconnect con_test_user;
44+
45+
connect con_test_user,127.0.0.1,test_user,,,$MASTER_MYPORT;
46+
select current_role;
47+
--error ER_INVALID_ROLE
48+
set role `new_role`;
49+
50+
connection default;
51+
disconnect con_test_user;
52+
53+
--echo #
54+
--echo # Test of anonymous user connection
55+
--echo --------------------------------------------------------------
56+
--source include/add_anonymous_users.inc
57+
# Skip windows, since it uses current user `Administrator` in buildbot.
58+
--source include/not_windows.inc
59+
grant test_role to ''@localhost;
60+
61+
connect(con1,localhost,'',,,$MASTER_MYPORT);
62+
SELECT CURRENT_ROLE;
63+
SET role test_role;
64+
SELECT CURRENT_ROLE;
65+
# user cannot set subset role, since it is not granted explicitly
66+
--error ER_INVALID_ROLE
67+
SET role new_role;
68+
--error ER_PASSWORD_ANONYMOUS_USER
69+
set default role test_role for ''@localhost;
70+
71+
connection default;
72+
disconnect con1;
73+
REVOKE all privileges, grant option from ''@localhost;
74+
--source include/delete_anonymous_users.inc
75+
76+
drop role new_role;
77+
drop role test_role;
78+
drop user test_user;

‎sql/sql_acl.cc

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3339,10 +3339,18 @@ static int check_user_can_set_role(THD *thd, const char *user,
33393339
check_role_is_granted_callback,
33403340
NULL) == -1))
33413341
{
3342-
/* Role is not granted but current user can see the role */
3343-
my_printf_error(ER_INVALID_ROLE, "User %`s@%`s has not been granted role %`s",
3344-
MYF(0), thd->security_ctx->priv_user,
3345-
thd->security_ctx->priv_host, rolename);
3342+
/* This happens for SET ROLE case and when `--skip-name-resolve` option
3343+
is used. In that situation host can be NULL and current user is always
3344+
target user, so printing `priv_user@priv_host` is not incorrect.
3345+
*/
3346+
if (!host)
3347+
my_printf_error(ER_INVALID_ROLE, "User %`s@%`s has not been granted role %`s",
3348+
MYF(0), thd->security_ctx->priv_user,
3349+
thd->security_ctx->priv_host, rolename);
3350+
else
3351+
/* Role is not granted but current user can see the role */
3352+
my_printf_error(ER_INVALID_ROLE, "User %`s@%`s has not been granted role %`s",
3353+
MYF(0), user, host, rolename);
33463354
}
33473355
else
33483356
{

0 commit comments

Comments
 (0)