1 files changed, 72 insertions, 73 deletions

diff --git a/sql/sql_trigger.cc b/sql/sql_trigger.cc
index f943b014118..b2b6b115f7d 100644
--- a/sql/sql_trigger.cc
+++ b/sql/sql_trigger.cc
@@ -187,20 +187,26 @@ bool mysql_create_or_drop_trigger(THD *thd, TABLE_LIST *tables, bool create)
   DBUG_ASSERT(tables->next_global == 0);
 
   /*
-    TODO: We should check if user has TRIGGER privilege for table here.
-    Now we just require SUPER privilege for creating/dropping because
-    we don't have proper privilege checking for triggers in place yet.
+    Check that the user has TRIGGER privilege on the subject table.
   */
-  if (check_global_access(thd, SUPER_ACL))
-    DBUG_RETURN(TRUE);
+  {
+    bool err_status;
+    TABLE_LIST **save_query_tables_own_last= thd->lex->query_tables_own_last;
+    thd->lex->query_tables_own_last= 0;
+
+    err_status= check_table_access(thd, TRIGGER_ACL, tables, 0);
+
+    thd->lex->query_tables_own_last= save_query_tables_own_last;
+
+    if (err_status)
+      DBUG_RETURN(TRUE);
+  }
 
   /*
     There is no DETERMINISTIC clause for triggers, so can't check it.
     But a trigger can in theory be used to do nasty things (if it supported
-    DROP for example) so we do the check for privileges. For now there is
-    already a stronger test right above; but when this stronger test will
-    be removed, the test below will hold. Because triggers have the same
-    nature as functions regarding binlogging: their body is implicitely
+    DROP for example) so we do the check for privileges. Triggers have the
+    same nature as functions regarding binlogging: their body is implicitely
     binlogged, so they share the same danger, so trust_function_creators
     applies to them too.
   */
@@ -212,7 +218,7 @@ bool mysql_create_or_drop_trigger(THD *thd, TABLE_LIST *tables, bool create)
   }
 
   /* We do not allow creation of triggers on temporary tables. */
-  if (create && find_temporary_table(thd, tables->db, tables->table_name))
+  if (create && find_temporary_table(thd, tables))
   {
     my_error(ER_TRG_ON_VIEW_OR_TEMP_TABLE, MYF(0), tables->alias);
     DBUG_RETURN(TRUE);
@@ -345,9 +351,8 @@ bool Table_triggers_list::create_trigger(THD *thd, TABLE_LIST *tables,
 {
   LEX *lex= thd->lex;
   TABLE *table= tables->table;
-  char dir_buff[FN_REFLEN], file_buff[FN_REFLEN], trigname_buff[FN_REFLEN],
-       trigname_path[FN_REFLEN];
-  LEX_STRING dir, file, trigname_file;
+  char file_buff[FN_REFLEN], trigname_buff[FN_REFLEN];
+  LEX_STRING file, trigname_file;
   LEX_STRING *trg_def, *name;
   ulonglong *trg_sql_mode;
   char trg_definer_holder[USER_HOST_BUFF_SIZE];
@@ -357,7 +362,8 @@ bool Table_triggers_list::create_trigger(THD *thd, TABLE_LIST *tables,
 
 
   /* Trigger must be in the same schema as target table. */
-  if (my_strcasecmp(table_alias_charset, table->s->db, lex->spname->m_db.str))
+  if (my_strcasecmp(table_alias_charset, table->s->db.str,
+                    lex->spname->m_db.str))
   {
     my_error(ER_TRG_IN_WRONG_SCHEMA, MYF(0));
     return 1;
@@ -449,20 +455,18 @@ bool Table_triggers_list::create_trigger(THD *thd, TABLE_LIST *tables,
     sql_create_definition_file() files handles renaming and backup of older
     versions
   */
-  strxnmov(dir_buff, FN_REFLEN, mysql_data_home, "/", tables->db, "/", NullS);
-  dir.length= unpack_filename(dir_buff, dir_buff);
-  dir.str= dir_buff;
-  file.length=  strxnmov(file_buff, FN_REFLEN, tables->table_name,
-                         triggers_file_ext, NullS) - file_buff;
+  file.length= build_table_filename(file_buff, FN_REFLEN-1,
+                                    tables->db, tables->table_name,
+                                    triggers_file_ext);
   file.str= file_buff;
-  trigname_file.length= strxnmov(trigname_buff, FN_REFLEN,
-                                 lex->spname->m_name.str,
-                                 trigname_file_ext, NullS) - trigname_buff;
+  trigname_file.length= build_table_filename(trigname_buff, FN_REFLEN-1,
+                                             tables->db,
+                                             lex->spname->m_name.str,
+                                             trigname_file_ext);
   trigname_file.str= trigname_buff;
-  strxnmov(trigname_path, FN_REFLEN, dir_buff, trigname_buff, NullS);
 
   /* Use the filesystem to enforce trigger namespace constraints. */
-  if (!access(trigname_path, F_OK))
+  if (!access(trigname_buff, F_OK))
   {
     my_error(ER_TRG_ALREADY_EXISTS, MYF(0));
     return 1;
@@ -471,7 +475,7 @@ bool Table_triggers_list::create_trigger(THD *thd, TABLE_LIST *tables,
   trigname.trigger_table.str= tables->table_name;
   trigname.trigger_table.length= tables->table_name_length;
 
-  if (sql_create_definition_file(&dir, &trigname_file, &trigname_file_type,
+  if (sql_create_definition_file(NULL, &trigname_file, &trigname_file_type,
                                  (gptr)&trigname, trigname_file_parameters, 0))
     return 1;
 
@@ -536,12 +540,12 @@ bool Table_triggers_list::create_trigger(THD *thd, TABLE_LIST *tables,
     trg_definer->length= 0;
   }
 
-  if (!sql_create_definition_file(&dir, &file, &triggers_file_type,
+  if (!sql_create_definition_file(NULL, &file, &triggers_file_type,
                                   (gptr)this, triggers_file_parameters, 0))
     return 0;
 
 err_with_cleanup:
-  my_delete(trigname_path, MYF(MY_WME));
+  my_delete(trigname_buff, MYF(MY_WME));
   return 1;
 }
 
@@ -564,9 +568,7 @@ err_with_cleanup:
 static bool rm_trigger_file(char *path, const char *db,
                             const char *table_name)
 {
-  strxnmov(path, FN_REFLEN, mysql_data_home, "/", db, "/", table_name,
-           triggers_file_ext, NullS);
-  unpack_filename(path, path);
+  build_table_filename(path, FN_REFLEN-1, db, table_name, triggers_file_ext);
   return my_delete(path, MYF(MY_WME));
 }
 
@@ -589,9 +591,7 @@ static bool rm_trigger_file(char *path, const char *db,
 static bool rm_trigname_file(char *path, const char *db,
                              const char *trigger_name)
 {
-  strxnmov(path, FN_REFLEN, mysql_data_home, "/", db, "/", trigger_name,
-           trigname_file_ext, NullS);
-  unpack_filename(path, path);
+  build_table_filename(path, FN_REFLEN-1, db, trigger_name, trigname_file_ext);
   return my_delete(path, MYF(MY_WME));
 }
 
@@ -613,18 +613,15 @@ static bool rm_trigname_file(char *path, const char *db,
 static bool save_trigger_file(Table_triggers_list *triggers, const char *db,
                               const char *table_name)
 {
-  char dir_buff[FN_REFLEN], file_buff[FN_REFLEN];
-  LEX_STRING dir, file;
-
-  strxnmov(dir_buff, FN_REFLEN, mysql_data_home, "/", db, "/", NullS);
-  dir.length= unpack_filename(dir_buff, dir_buff);
-  dir.str= dir_buff;
-  file.length=  strxnmov(file_buff, FN_REFLEN, table_name, triggers_file_ext,
-                         NullS) - file_buff;
-  file.str= file_buff;
+  char file_buff[FN_REFLEN];
+  LEX_STRING file;
 
-  return sql_create_definition_file(&dir, &file, &triggers_file_type,
-                                    (gptr)triggers, triggers_file_parameters, 0);
+  file.length= build_table_filename(file_buff, FN_REFLEN-1, db, table_name,
+                                    triggers_file_ext);
+  file.str= file_buff;
+  return sql_create_definition_file(NULL, &file, &triggers_file_type,
+                                    (gptr)triggers, triggers_file_parameters,
+                                    0);
 }
 
 
@@ -738,7 +735,7 @@ bool Table_triggers_list::prepare_record1_accessors(TABLE *table)
     */
     if (!(*old_fld= (*fld)->new_field(&table->mem_root, table)))
       return 1;
-    (*old_fld)->move_field((my_ptrdiff_t)(table->record[1] -
+    (*old_fld)->move_field_offset((my_ptrdiff_t)(table->record[1] -
                                           table->record[0]));
   }
   *old_fld= 0;
@@ -793,9 +790,8 @@ bool Table_triggers_list::check_n_load(THD *thd, const char *db,
 
   DBUG_ENTER("Table_triggers_list::check_n_load");
 
-  strxnmov(path_buff, FN_REFLEN, mysql_data_home, "/", db, "/", table_name,
-           triggers_file_ext, NullS);
-  path.length= unpack_filename(path_buff, path_buff);
+  path.length= build_table_filename(path_buff, FN_REFLEN-1,
+                                    db, table_name, triggers_file_ext);
   path.str= path_buff;
 
   // QQ: should we analyze errno somehow ?
@@ -976,7 +972,7 @@ bool Table_triggers_list::check_n_load(THD *thd, const char *db,
             schema.
           */
 
-          lex.sphead->set_definer("", 0);
+          lex.sphead->set_definer((char*) "", 0);
 
           /*
             Triggers without definer information are executed under the
@@ -1145,9 +1141,9 @@ static TABLE_LIST *add_table_for_trigger(THD *thd, sp_name *trig)
   
   DBUG_ENTER("add_table_for_trigger");
 
-  strxnmov(path_buff, FN_REFLEN, mysql_data_home, "/", trig->m_db.str, "/",
-           trig->m_name.str, trigname_file_ext, NullS);
-  path.length= unpack_filename(path_buff, path_buff);
+  path.length= build_table_filename(path_buff, FN_REFLEN-1,
+                                    trig->m_db.str, trig->m_name.str,
+                                    trigname_file_ext);
   path.str= path_buff;
 
   if (access(path_buff, F_OK))
@@ -1344,26 +1340,24 @@ Table_triggers_list::change_table_name_in_trignames(const char *db_name,
                                                     LEX_STRING *new_table_name,
                                                     LEX_STRING *stopper)
 {
-  char dir_buff[FN_REFLEN], trigname_buff[FN_REFLEN];
+  char trigname_buff[FN_REFLEN];
   struct st_trigname trigname;
-  LEX_STRING dir, trigname_file;
+  LEX_STRING trigname_file;
   LEX_STRING *trigger;
   List_iterator_fast<LEX_STRING> it_name(names_list);
 
-  strxnmov(dir_buff, FN_REFLEN, mysql_data_home, "/", db_name, "/", NullS);
-  dir.length= unpack_filename(dir_buff, dir_buff);
-  dir.str= dir_buff;
-
   while ((trigger= it_name++) != stopper)
   {
-    trigname_file.length= strxnmov(trigname_buff, FN_REFLEN, trigger->str,
-                                   trigname_file_ext, NullS) - trigname_buff;
+    trigname_file.length= build_table_filename(trigname_buff, FN_REFLEN-1,
+                                               db_name, trigger->str,
+                                               trigname_file_ext);
     trigname_file.str= trigname_buff;
 
     trigname.trigger_table= *new_table_name;
 
-    if (sql_create_definition_file(&dir, &trigname_file, &trigname_file_type,
-        (gptr)&trigname, trigname_file_parameters, 0))
+    if (sql_create_definition_file(NULL, &trigname_file, &trigname_file_type,
+                                   (gptr)&trigname, trigname_file_parameters,
+                                   0))
       return trigger;
   }
 
@@ -1494,16 +1488,6 @@ bool Table_triggers_list::process_triggers(THD *thd, trg_event_type event,
       return TRUE;
 
     /*
-      NOTE: TRIGGER_ACL should be used below.
-    */
-
-    if (check_global_access(thd, SUPER_ACL))
-    {
-      sp_restore_security_context(thd, save_ctx);
-      return TRUE;
-    }
-
-    /*
       Fetch information about table-level privileges to GRANT_INFO structure for
       subject table. Check of privileges that will use it and information about
       column-level privileges will happen in Item_trigger_field::fix_fields().
@@ -1511,7 +1495,22 @@ bool Table_triggers_list::process_triggers(THD *thd, trg_event_type event,
 
     fill_effective_table_privileges(thd,
                                     &subject_table_grants[event][time_type],
-                                    table->s->db, table->s->table_name);
+                                    table->s->db.str, table->s->table_name.str);
+
+    /* Check that the definer has TRIGGER privilege on the subject table. */
+
+    if (!(subject_table_grants[event][time_type].privilege & TRIGGER_ACL))
+    {
+      char priv_desc[128];
+      get_privilege_desc(priv_desc, sizeof(priv_desc), TRIGGER_ACL);
+
+      my_error(ER_TABLEACCESS_DENIED_ERROR, MYF(0), priv_desc,
+               thd->security_ctx->priv_user, thd->security_ctx->host_or_ip,
+               table->s->table_name.str);
+
+      sp_restore_security_context(thd, save_ctx);
+      return TRUE;
+    }
 #endif // NO_EMBEDDED_ACCESS_CHECKS
 
     thd->reset_sub_statement_state(&statement_state, SUB_STMT_TRIGGER);