diff options
| author | Sergei Golubchik <sergii@pisem.net> | 2014-03-20 23:26:41 +0100 |
|---|---|---|
| committer | Sergei Golubchik <sergii@pisem.net> | 2014-03-20 23:26:41 +0100 |
| commit | 7b1b744f53aca6ca77f06cb1980c40da666387d1 (patch) | |
| tree | 1d42894ed10d0e66db74614304f04293ab33dcde /sql/item_func.cc | |
| parent | 9ff0c9f730a79d4dab4303163d45c919f612cc37 (diff) | |
| download | mariadb-git-7b1b744f53aca6ca77f06cb1980c40da666387d1.tar.gz | |
MDEV-5849 MySQL bug#12602983 - User without privilege on routine can discover its existence by executing "select non_existing_func();" or by "call non_existing_proc()"
add or move privilege checks before existence checks
Diffstat (limited to 'sql/item_func.cc')
| -rw-r--r-- | sql/item_func.cc | 32 |
1 files changed, 23 insertions, 9 deletions
diff --git a/sql/item_func.cc b/sql/item_func.cc index c659d7964b9..eb176d7e490 100644 --- a/sql/item_func.cc +++ b/sql/item_func.cc @@ -6741,22 +6741,18 @@ Item_func_sp::execute_impl(THD *thd) { bool err_status= TRUE; Sub_statement_state statement_state; -#ifndef NO_EMBEDDED_ACCESS_CHECKS Security_context *save_security_ctx= thd->security_ctx; -#endif enum enum_sp_data_access access= (m_sp->m_chistics->daccess == SP_DEFAULT_ACCESS) ? SP_DEFAULT_ACCESS_MAPPING : m_sp->m_chistics->daccess; DBUG_ENTER("Item_func_sp::execute_impl"); -#ifndef NO_EMBEDDED_ACCESS_CHECKS if (context->security_ctx) { /* Set view definer security context */ thd->security_ctx= context->security_ctx; } -#endif if (sp_check_access(thd)) goto error; @@ -6784,9 +6780,7 @@ Item_func_sp::execute_impl(THD *thd) thd->restore_sub_statement_state(&statement_state); error: -#ifndef NO_EMBEDDED_ACCESS_CHECKS thd->security_ctx= save_security_ctx; -#endif DBUG_RETURN(err_status); } @@ -6857,11 +6851,9 @@ Item_func_sp::sp_check_access(THD *thd) { DBUG_ENTER("Item_func_sp::sp_check_access"); DBUG_ASSERT(m_sp); -#ifndef NO_EMBEDDED_ACCESS_CHECKS if (check_routine_access(thd, EXECUTE_ACL, m_sp->m_db.str, m_sp->m_name.str, 0, FALSE)) DBUG_RETURN(TRUE); -#endif DBUG_RETURN(FALSE); } @@ -6873,7 +6865,29 @@ Item_func_sp::fix_fields(THD *thd, Item **ref) bool res; DBUG_ENTER("Item_func_sp::fix_fields"); DBUG_ASSERT(fixed == 0); - + + /* + Checking privileges to execute the function while creating view and + executing the function of select. + */ + if (!(thd->lex->context_analysis_only & CONTEXT_ANALYSIS_ONLY_VIEW) || + (thd->lex->sql_command == SQLCOM_CREATE_VIEW)) + { + Security_context *save_security_ctx= thd->security_ctx; + if (context->security_ctx) + thd->security_ctx= context->security_ctx; + + res= check_routine_access(thd, EXECUTE_ACL, m_name->m_db.str, + m_name->m_name.str, 0, FALSE); + thd->security_ctx= save_security_ctx; + + if (res) + { + context->process_error(thd); + DBUG_RETURN(res); + } + } + /* We must call init_result_field before Item_func::fix_fields() to make m_sp and result_field members available to fix_length_and_dec(), |