BUG#7391 - Cross-database multi-table UPDATE uses active database

           privileges

This problem is 4.1 specific. It doesn't affect 4.0 and was fixed
in 5.x before.

Having any mysql user who is allowed to issue multi table update
statement and any column/table grants, allows this user to update
any table on a server (mysql grant tables are not exception).

check_grant() accepts number of tables (in table list) to be checked
in 5-th param. While checking grants for multi table update, number
of tables must be 1. It must never be 0 (actually we have
DBUG_ASSERT(number > 0) in 5.x in grant_check() function).


mysql-test/r/grant.result:
  Addition to test case for bug#7391:
  - Added grant statement to trigger this problem in 4.1.
  - Fixed error messages.
mysql-test/t/grant.test:
  Addition to test case for bug#7391:
  - Added grant statement to trigger this problem in 4.1.
  - Fixed error messages.
sql/sql_update.cc:
  check_grant() accepts number of tables (in table list) to be checked
  in 5-th param. For this particular check number of tables must be 1.
  It must never be 0 (actually we have DBUG_ASSERT(number > 0) in 5.x
  in grant_check() function).

1 files changed, 6 insertions, 4 deletions

diff --git a/mysql-test/t/grant.test b/mysql-test/t/grant.test
index 60b60547fcc..3365145650a 100644
--- a/mysql-test/t/grant.test
+++ b/mysql-test/t/grant.test
@@ -323,7 +323,7 @@ connection conn1;
 show grants for mysqltest_3@localhost;
 --error 1143
 update mysqltest_1.t1, mysqltest_1.t2 set q=10 where b=1;
---error 1143
+--error 1142
 update mysqltest_1.t1, mysqltest_2.t2 set d=20 where d=1;
 --error 1143
 update mysqltest_2.t1, mysqltest_1.t2 set c=20 where b=1;
@@ -343,6 +343,8 @@ revoke all on mysqltest_2.t2 from mysqltest_3@localhost;
 #test the db/table level privileges
 grant all on mysqltest_2.* to mysqltest_3@localhost;
 grant select on *.* to mysqltest_3@localhost;
+# Next grant is needed to trigger bug#7391. Do not optimize!
+grant select on mysqltest_2.t1 to mysqltest_3@localhost;
 flush privileges;
 disconnect conn1;
 connect (conn2,localhost,mysqltest_3,,);
@@ -354,11 +356,11 @@ update mysqltest_2.t1, mysqltest_2.t2 set c=500,d=600;
 update mysqltest_1.t1, mysqltest_1.t2 set a=100,b=200;
 use mysqltest_2;
 #the following used to succeed, it must fail now.
---error 1044
+--error 1142
 update mysqltest_1.t1, mysqltest_1.t2 set a=100,b=200;
---error 1044
+--error 1142
 update mysqltest_2.t1, mysqltest_1.t2 set c=100,b=200;
---error 1044
+--error 1142
 update mysqltest_1.t1, mysqltest_2.t2 set a=100,d=200;
 #lets see the result
 connection master;