diff options
Diffstat (limited to 'sql/sql_base.cc')
| -rw-r--r-- | sql/sql_base.cc | 39 |
1 files changed, 32 insertions, 7 deletions
diff --git a/sql/sql_base.cc b/sql/sql_base.cc index 36b9d53ce85..39030462f0b 100644 --- a/sql/sql_base.cc +++ b/sql/sql_base.cc @@ -7620,9 +7620,34 @@ insert_fields(THD *thd, Name_resolution_context *context, const char *db_name, continue; #ifndef NO_EMBEDDED_ACCESS_CHECKS - /* Ensure that we have access rights to all fields to be inserted. */ - if (!((table && (table->grant.privilege & SELECT_ACL) || - tables->view && (tables->grant.privilege & SELECT_ACL))) && + /* + Ensure that we have access rights to all fields to be inserted. Under + some circumstances, this check may be skipped. + + - If any_privileges is true, skip the check. + + - If the SELECT privilege has been found as fulfilled already for both + the TABLE and TABLE_LIST objects (and both of these exist, of + course), the check is skipped. + + - If the SELECT privilege has been found fulfilled for the TABLE object + and the TABLE_LIST represents a derived table other than a view (see + below), the check is skipped. + + - If the TABLE_LIST object represents a view, we may skip checking if + the SELECT privilege has been found fulfilled for it, regardless of + the TABLE object. + + - If there is no TABLE object, the test is skipped if either + * the TABLE_LIST does not represent a view, or + * the SELECT privilege has been found fulfilled. + + A TABLE_LIST that is not a view may be a subquery, an + information_schema table, or a nested table reference. See the comment + for TABLE_LIST. + */ + if (!(table && !tables->view && (table->grant.privilege & SELECT_ACL) || + tables->view && (tables->grant.privilege & SELECT_ACL)) && !any_privileges) { field_iterator.set(tables); @@ -7676,19 +7701,19 @@ insert_fields(THD *thd, Name_resolution_context *context, const char *db_name, tables->is_natural_join); DBUG_ASSERT(item->type() == Item::FIELD_ITEM); Item_field *fld= (Item_field*) item; - const char *field_table_name= field_iterator.table_name(); + const char *field_table_name= field_iterator.get_table_name(); if (!tables->schema_table && !(fld->have_privileges= (get_column_grant(thd, field_iterator.grant(), - field_iterator.db_name(), + field_iterator.get_db_name(), field_table_name, fld->field_name) & VIEW_ANY_ACL))) { - my_error(ER_COLUMNACCESS_DENIED_ERROR, MYF(0), "ANY", + my_error(ER_TABLEACCESS_DENIED_ERROR, MYF(0), "ANY", thd->security_ctx->priv_user, thd->security_ctx->host_or_ip, - fld->field_name, field_table_name); + field_table_name); DBUG_RETURN(TRUE); } } |