Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot read from MV without SELECT privileges on Source table (SQL SECURITY) #64335

Open
fm4v opened this issue May 24, 2024 · 1 comment
Open
Assignees

Comments

@fm4v
Copy link
Member

fm4v commented May 24, 2024

If source table doesn't have SELECT privilege for DEFINER user, then any user can't read data from MV (not target).

Steps to reproduce:

pastila https://pastila.nl/?0071145c/d862152c9e1bea40efc7cee13e66352c#LG7ES2e24rNOGW0sBOGfsw== | clickhouse-client -n --echo

Result:

Code: 497. DB::Exception: Received from localhost:9000. DB::Exception: user_: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(s) ON test.src. (ACCESS_DENIED)
(query: SELECT * FROM mv2; )
@fm4v fm4v added the potential bug To be reviewed by developers and confirmed/rejected. label May 24, 2024
@alexey-milovidov alexey-milovidov added unexpected behaviour and removed potential bug To be reviewed by developers and confirmed/rejected. labels May 24, 2024
@pufit
Copy link
Member

pufit commented May 27, 2024

This is probably not intended behavior, but still you shouldn't use a user without a SELECT grant on the source table as a definer because it will be impossible to insert into such MV.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants