Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

executor,planner: Improve SET PASSWORD #8426

Merged
merged 5 commits into from Nov 26, 2018
Merged

executor,planner: Improve SET PASSWORD #8426

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4ec77d5
executor,planner: Improve SET PASSWORD
morgo Nov 23, 2018
53882ca
Merge branch 'master' into set-password
morgo Nov 23, 2018
62bbbc2
Merge branch 'master' into set-password
morgo Nov 26, 2018
3085b1d
Merge branch 'master' into set-password
morgo Nov 26, 2018
9c53957
Merge branch 'master' into set-password
zz-jason Nov 26, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
19 changes: 14 additions & 5 deletions executor/simple.go
View file
Open in desktop
Expand Up @@ -26,6 +26,7 @@ import (
"github.com/pingcap/tidb/config"
"github.com/pingcap/tidb/domain"
"github.com/pingcap/tidb/infoschema"
"github.com/pingcap/tidb/privilege"
"github.com/pingcap/tidb/sessionctx"
"github.com/pingcap/tidb/sessionctx/variable"
"github.com/pingcap/tidb/util/chunk"
Expand Down Expand Up @@ -287,14 +288,22 @@ func userExists(ctx sessionctx.Context, name string, host string) (bool, error)
}

func (e *SimpleExec) executeSetPwd(s *ast.SetPwdStmt) error {
var u, h string
if s.User == nil {
vars := e.ctx.GetSessionVars()
s.User = vars.User
if s.User == nil {
if e.ctx.GetSessionVars().User == nil {
return errors.New("Session error is empty")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why the error is "Session error is empty"? Although it is not related to this PR.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When the test-suite runs, it doesn't always have a session. This error is pre-existing, I just moved it around.

}
u = e.ctx.GetSessionVars().User.AuthUsername
h = e.ctx.GetSessionVars().User.AuthHostname
} else {
checker := privilege.GetPrivilegeManager(e.ctx)
if checker != nil && !checker.RequestVerification("", "", "", mysql.SuperPriv) {
return ErrDBaccessDenied.GenWithStackByArgs(u, h, "mysql")
}
u = s.User.Username
h = s.User.Hostname
}
exists, err := userExists(e.ctx, s.User.Username, s.User.Hostname)
exists, err := userExists(e.ctx, u, h)
if err != nil {
return errors.Trace(err)
}
Expand All @@ -303,7 +312,7 @@ func (e *SimpleExec) executeSetPwd(s *ast.SetPwdStmt) error {
}

// update mysql.user
sql := fmt.Sprintf(`UPDATE %s.%s SET password="%s" WHERE User="%s" AND Host="%s";`, mysql.SystemDB, mysql.UserTable, auth.EncodePassword(s.Password), s.User.Username, s.User.Hostname)
sql := fmt.Sprintf(`UPDATE %s.%s SET password="%s" WHERE User="%s" AND Host="%s";`, mysql.SystemDB, mysql.UserTable, auth.EncodePassword(s.Password), u, h)
_, _, err = e.ctx.(sqlexec.RestrictedSQLExecutor).ExecRestrictedSQL(e.ctx, sql)
domain.GetDomain(e.ctx).NotifyUpdatePrivilege(e.ctx)
return errors.Trace(err)
Expand Down
5 changes: 3 additions & 2 deletions executor/simple_test.go
View file
Open in desktop
Expand Up @@ -219,15 +219,16 @@ func (s *testSuite) TestSetPwd(c *C) {
tk.Se, err = session.CreateSession4Test(s.store)
c.Check(err, IsNil)
ctx := tk.Se.(sessionctx.Context)
ctx.GetSessionVars().User = &auth.UserIdentity{Username: "testpwd1", Hostname: "localhost"}
ctx.GetSessionVars().User = &auth.UserIdentity{Username: "testpwd1", Hostname: "localhost", AuthUsername: "testpwd1", AuthHostname: "localhost"}
// Session user doesn't exist.
_, err = tk.Exec(setPwdSQL)
c.Check(terror.ErrorEqual(err, executor.ErrPasswordNoMatch), IsTrue, Commentf("err %v", err))
// normal
ctx.GetSessionVars().User = &auth.UserIdentity{Username: "testpwd", Hostname: "localhost"}
ctx.GetSessionVars().User = &auth.UserIdentity{Username: "testpwd", Hostname: "localhost", AuthUsername: "testpwd", AuthHostname: "localhost"}
tk.MustExec(setPwdSQL)
result = tk.MustQuery(`SELECT Password FROM mysql.User WHERE User="testpwd" and Host="localhost"`)
result.Check(testkit.Rows(auth.EncodePassword("pwd")))

}

func (s *testSuite) TestKillStmt(c *C) {
Expand Down
4 changes: 1 addition & 3 deletions planner/core/logical_plan_test.go
View file
Open in desktop
Expand Up @@ -1709,9 +1709,7 @@ func (s *testPlanSuite) TestVisitInfo(c *C) {
},
{
sql: `set password for 'root'@'%' = 'xxxxx'`,
ans: []visitInfo{
{mysql.SuperPriv, "", "", ""},
},
ans: []visitInfo{},
},
{
sql: `show create table test.ttt`,
Expand Down
2 changes: 1 addition & 1 deletion planner/core/planbuilder.go
View file
Open in desktop
Expand Up @@ -961,7 +961,7 @@ func (b *PlanBuilder) buildSimple(node ast.StmtNode) Plan {
b.visitInfo = appendVisitInfo(b.visitInfo, mysql.CreateUserPriv, "", "", "")
case *ast.GrantStmt:
b.visitInfo = collectVisitInfoFromGrantStmt(b.visitInfo, raw)
case *ast.SetPwdStmt, *ast.RevokeStmt:
case *ast.RevokeStmt:
b.visitInfo = appendVisitInfo(b.visitInfo, mysql.SuperPriv, "", "", "")
case *ast.KillStmt:
// If you have the SUPER privilege, you can kill all threads and statements.
Expand Down
20 changes: 20 additions & 0 deletions privilege/privileges/privileges_test.go
View file
Open in desktop
Expand Up @@ -274,6 +274,26 @@ func (s *testPrivilegeSuite) TestDropTablePriv(c *C) {
mustExec(c, se, `DROP TABLE todrop;`)
}

func (s *testPrivilegeSuite) TestSetPasswdStmt(c *C) {

se := newSession(c, s.store, s.dbName)

// high privileged user setting password for other user (passes)
mustExec(c, se, "CREATE USER 'superuser'")
mustExec(c, se, "CREATE USER 'nobodyuser'")
mustExec(c, se, "GRANT ALL ON *.* TO 'superuser'")
mustExec(c, se, "FLUSH PRIVILEGES")

c.Assert(se.Auth(&auth.UserIdentity{Username: "superuser", Hostname: "localhost", AuthUsername: "superuser", AuthHostname: "%"}, nil, nil), IsTrue)
mustExec(c, se, "SET PASSWORD for 'nobodyuser' = 'newpassword'")

// low privileged user trying to set password for other user (fails)
c.Assert(se.Auth(&auth.UserIdentity{Username: "nobodyuser", Hostname: "localhost", AuthUsername: "nobodyuser", AuthHostname: "%"}, nil, nil), IsTrue)
_, err := se.Execute(context.Background(), "SET PASSWORD for 'superuser' = 'newpassword'")
c.Assert(err, NotNil)

}

func (s *testPrivilegeSuite) TestCheckAuthenticate(c *C) {

se := newSession(c, s.store, s.dbName)
Expand Down