1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

BUG#27160888: MISSING FILE PRIVILEDGE CHECKS ON SOME

Browse Source 
STATEMENTS

ANALYSIS:
=========
A user not having FILE privilege is not allowed to create
custom data/index directories for a table or for its
partitions via CREATE TABLE but is allowed to do so via
ALTER TABLE statement.

ALTER TABLE ignores DATA DIRECTORY and INDEX DIRECTORY when
given as table options. The issue occurs during the
creation of partitions for a table via ALTER TABLE
statement with the DATA DIRECTORY and/or INDEX DIRECTORY
options. The issue exists because of the absence of FILE
privilege check for the user.

FIX:
====
A FILE privilege check has been introduced for resolving
the above scenario.
This commit is contained in:
Karthik Kamath 2018-01-11 19:48:12 +05:30
parent 20e75a3efd
commit 2af9e8af6e
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sql/sql_alter.cc
View File

@ -1,4 +1,4 @@
/* Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
/* Copyright (c) 2010, 2018, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@ -18,6 +18,8 @@
// mysql_exchange_partition
#include "sql_alter.h"
bool has_external_data_or_index_dir(partition_info &pi);
bool Alter_table_statement::execute(THD *thd)
{
LEX *lex= thd->lex;
@ -42,6 +44,16 @@ bool Alter_table_statement::execute(THD *thd)
if (thd->is_fatal_error) /* out of memory creating a copy of alter_info */
DBUG_RETURN(TRUE);
#ifdef WITH_PARTITION_STORAGE_ENGINE
{
partition_info *part_info= thd->lex->part_info;
if (part_info != NULL && has_external_data_or_index_dir(*part_info) &&
check_access(thd, FILE_ACL, any_db, NULL, NULL, FALSE, FALSE))
DBUG_RETURN(TRUE);
}
#endif
/*
We also require DROP priv for ALTER TABLE ... DROP PARTITION, as well
as for RENAME TO, as being done by SQLCOM_RENAME_TABLE