diff options
author | <Li-Bing.Song@sun.com> | 2010-07-29 11:00:57 +0800 |
---|---|---|
committer | <Li-Bing.Song@sun.com> | 2010-07-29 11:00:57 +0800 |
commit | 2ad690fdf8a1141be8439a7e2d53974a0d3ec923 (patch) | |
tree | 49835843b47b50726e5c3eb2fde225851827a677 /sql/sql_partition.cc | |
parent | f860873c0d1a16b85388f7d02c5bd2d201087513 (diff) | |
download | mariadb-git-2ad690fdf8a1141be8439a7e2d53974a0d3ec923.tar.gz |
BUG#49124 Security issue with /*!-versioned */ SQL statements on Slave
/*![:version:] Query Code */, where [:version:] is a sequence of 5
digits representing the mysql server version(e.g /*!50200 ... */),
is a special comment that the query in it can be executed on those
servers whose versions are larger than the version appearing in the
comment. It leads to a security issue when slave's version is larger
than master's. A malicious user can improve his privileges on slaves.
Because slave SQL thread is running with SUPER privileges, so it can
execute queries that he/she does not have privileges on master.
This bug is fixed with the logic below:
- To replace '!' with ' ' in the magic comments which are not applied on
master. So they become common comments and will not be applied on slave.
- Example:
'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /*!99999 ,(3)*/
will be binlogged as
'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /* 99999 ,(3)*/
Diffstat (limited to 'sql/sql_partition.cc')
-rw-r--r-- | sql/sql_partition.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sql/sql_partition.cc b/sql/sql_partition.cc index 122ae661046..76caa2b0c8d 100644 --- a/sql/sql_partition.cc +++ b/sql/sql_partition.cc @@ -3876,7 +3876,7 @@ void get_partition_set(const TABLE *table, uchar *buf, const uint index, */ bool mysql_unpack_partition(THD *thd, - const char *part_buf, uint part_info_len, + char *part_buf, uint part_info_len, const char *part_state, uint part_state_len, TABLE* table, bool is_create_table_ind, handlerton *default_db_type, |