summaryrefslogtreecommitdiff
path: root/sql/sql_acl.cc
diff options
context:
space:
mode:
authorSergei Golubchik <serg@mariadb.org>2019-03-10 23:59:50 +0100
committerSergei Golubchik <serg@mariadb.org>2019-03-12 13:10:49 +0100
commita62e9a83c04738009918ae63da41c9bea7ab941e (patch)
tree16b9b101d29ae755e159bf024e53a8a1d73d250f /sql/sql_acl.cc
parent22f1cf9292f859f2f59208f267917481b29d4739 (diff)
downloadmariadb-git-a62e9a83c04738009918ae63da41c9bea7ab941e.tar.gz
MDEV-15945 --ps-protocol does not test some queries
Make mysqltest to use --ps-protocol more use prepared statements for everything that server supports with the exception of CALL (for now). Fix discovered test failures and bugs. tests: * PROCESSLIST shows Execute state, not Query * SHOW STATUS increments status variables more than in text protocol * multi-statements should be avoided (see tests with a wrong delimiter) * performance_schema events have different names in --ps-protocol * --enable_prepare_warnings mysqltest.cc: * make sure run_query_stmt() doesn't crash if there's no active connection (in wait_until_connected_again.inc) * prepare all statements that server supports protocol.h * Protocol_discard::send_result_set_metadata() should not send anything to the client. sql_acl.cc: * extract the functionality of getting the user for SHOW GRANTS from check_show_access(), so that mysql_test_show_grants() could generate the correct column names in the prepare step sql_class.cc: * result->prepare() can fail, don't ignore its return value * use correct number of decimals for EXPLAIN columns sql_parse.cc: * discard profiling for SHOW PROFILE. In text protocol it's done in prepare_schema_table(), but in --ps it is called on prepare only, so nothing was discarding profiling during execute. * move the permission checking code for SHOW CREATE VIEW to mysqld_show_create_get_fields(), so that it would be called during prepare step too. * only set sel_result when it was created here and needs to be destroyed in the same block. Avoid destroying lex->result. * use the correct number of tables in check_show_access(). Saying "as many as possible" doesn't work when first_not_own_table isn't set yet. sql_prepare.cc: * use correct user name for SHOW GRANTS columns * don't ignore verbose flag for SHOW SLAVE STATUS * support preparing REVOKE ALL and ROLLBACK TO SAVEPOINT * don't ignore errors from thd->prepare_explain_fields() * use select_send result for sending ANALYZE and EXPLAIN, but don't overwrite lex->result, because it might be needed to issue execute-time errors (select_dumpvar - too many rows) sql_show.cc: * check grants for SHOW CREATE VIEW here, not in mysql_execute_command sql_view.cc: * use the correct function to check privileges. Old code was doing check_access() for thd->security_ctx, which is invoker's sctx, not definer's sctx. Hide various view related errors from the invoker. sql_yacc.yy: * initialize lex->select_lex for LOAD, otherwise it'll contain garbage data that happen to fail tests with views in --ps (but not otherwise).
Diffstat (limited to 'sql/sql_acl.cc')
-rw-r--r--sql/sql_acl.cc92
1 files changed, 50 insertions, 42 deletions
diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc
index 6052284428e..9110834b449 100644
--- a/sql/sql_acl.cc
+++ b/sql/sql_acl.cc
@@ -7776,6 +7776,51 @@ void mysql_show_grants_get_fields(THD *thd, List<Item> *fields,
fields->push_back(field, thd->mem_root);
}
+bool get_show_user(THD *thd, LEX_USER *lex_user, const char **username,
+ const char **hostname, const char **rolename)
+{
+ if (lex_user->user.str == current_user.str)
+ {
+ *username= thd->security_ctx->priv_user;
+ *hostname= thd->security_ctx->priv_host;
+ return 0;
+ }
+ if (lex_user->user.str == current_role.str)
+ {
+ *rolename= thd->security_ctx->priv_role;
+ return 0;
+ }
+ if (lex_user->user.str == current_user_and_current_role.str)
+ {
+ *username= thd->security_ctx->priv_user;
+ *hostname= thd->security_ctx->priv_host;
+ *rolename= thd->security_ctx->priv_role;
+ return 0;
+ }
+
+ Security_context *sctx= thd->security_ctx;
+ bool do_check_access;
+
+ if (!(lex_user= get_current_user(thd, lex_user)))
+ return 1;
+
+ if (lex_user->is_role())
+ {
+ *rolename= lex_user->user.str;
+ do_check_access= strcmp(*rolename, sctx->priv_role);
+ }
+ else
+ {
+ *username= lex_user->user.str;
+ *hostname= lex_user->host.str;
+ do_check_access= strcmp(*username, sctx->priv_user) ||
+ strcmp(*hostname, sctx->priv_host);
+ }
+
+ if (do_check_access && check_access(thd, SELECT_ACL, "mysql", 0, 0, 1, 0))
+ return 1;
+ return 0;
+}
/*
SHOW GRANTS; Send grants for a user to the client
@@ -7791,9 +7836,9 @@ bool mysql_show_grants(THD *thd, LEX_USER *lex_user)
ACL_ROLE *acl_role= NULL;
char buff[1024];
Protocol *protocol= thd->protocol;
- char *username= NULL;
- char *hostname= NULL;
- char *rolename= NULL;
+ const char *username= NULL;
+ const char *hostname= NULL;
+ const char *rolename= NULL;
DBUG_ENTER("mysql_show_grants");
if (!initialized)
@@ -7802,46 +7847,9 @@ bool mysql_show_grants(THD *thd, LEX_USER *lex_user)
DBUG_RETURN(TRUE);
}
- if (lex_user->user.str == current_user.str)
- {
- username= thd->security_ctx->priv_user;
- hostname= thd->security_ctx->priv_host;
- }
- else if (lex_user->user.str == current_role.str)
- {
- rolename= thd->security_ctx->priv_role;
- }
- else if (lex_user->user.str == current_user_and_current_role.str)
- {
- username= thd->security_ctx->priv_user;
- hostname= thd->security_ctx->priv_host;
- rolename= thd->security_ctx->priv_role;
- }
- else
- {
- Security_context *sctx= thd->security_ctx;
- bool do_check_access;
-
- lex_user= get_current_user(thd, lex_user);
- if (!lex_user)
- DBUG_RETURN(TRUE);
-
- if (lex_user->is_role())
- {
- rolename= lex_user->user.str;
- do_check_access= strcmp(rolename, sctx->priv_role);
- }
- else
- {
- username= lex_user->user.str;
- hostname= lex_user->host.str;
- do_check_access= strcmp(username, sctx->priv_user) ||
- strcmp(hostname, sctx->priv_host);
- }
+ if (get_show_user(thd, lex_user, &username, &hostname, &rolename))
+ DBUG_RETURN(TRUE);
- if (do_check_access && check_access(thd, SELECT_ACL, "mysql", 0, 0, 1, 0))
- DBUG_RETURN(TRUE);
- }
DBUG_ASSERT(rolename || username);
List<Item> field_list;