From f9d068bc09c3b415e8212897692b93a9fee5aae1 Mon Sep 17 00:00:00 2001 From: unknown Date: Tue, 23 Oct 2007 06:54:31 +0200 Subject: [PATCH 1/2] Bug #20901: CREATE privilege is enough to insert into a table CREATE TABLE IF NOT EXISTS ... SELECT let you insert into an existing table as long as you had the CREATE privilege. CREATE ... SELECT variants now always require INSERT privilege on target table. mysql-test/r/create.result: Show that CREATE...SELECT requires INSERT privilege on target table. mysql-test/r/grant.result: Sort output for a defined state. mysql-test/t/create.test: Show that CREATE...SELECT requires INSERT privilege on target table. mysql-test/t/grant.test: Sort output for a defined state. sql/sql_parse.cc: Require INSERT privilege on target table for CREATE ... SELECT. --- mysql-test/r/create.result | 38 +++++++++++++++++++ mysql-test/r/grant.result | 6 +-- mysql-test/t/create.test | 76 ++++++++++++++++++++++++++++++++++++++ mysql-test/t/grant.test | 2 +- sql/sql_parse.cc | 9 ++++- 5 files changed, 126 insertions(+), 5 deletions(-) diff --git a/mysql-test/r/create.result b/mysql-test/r/create.result index aa25c55f394..17894c65109 100644 --- a/mysql-test/r/create.result +++ b/mysql-test/r/create.result @@ -701,3 +701,41 @@ t2 CREATE TABLE `t2` ( drop table t1, t2; create table t1(a set("a,b","c,d") not null); ERROR HY000: Illegal set 'a,b' value found during parsing +create database mysqltest; +use mysqltest; +grant create on mysqltest.* to mysqltest@localhost; +create table t1 (i INT); +insert into t1 values (1); +ERROR 42000: Access denied for user 'mysqltest'@'localhost' to database 'mysqltest' +create table t2 (i INT); +create table t4 (i INT); +grant select, insert on mysqltest.t2 to mysqltest@localhost; +grant insert on mysqltest.t4 to mysqltest@localhost; +grant create, insert on mysqltest.t5 to mysqltest@localhost; +grant create, insert on mysqltest.t6 to mysqltest@localhost; +flush privileges; +insert into t2 values (1); +create table if not exists t1 select * from t2; +ERROR 42000: INSERT command denied to user 'mysqltest'@'localhost' for table 't1' +create table if not exists t3 select * from t2; +ERROR 42000: INSERT command denied to user 'mysqltest'@'localhost' for table 't3' +create table if not exists t4 select * from t2; +Warnings: +Note 1050 Table 't4' already exists +create table if not exists t5 select * from t2; +create table t6 select * from t2; +create table t7 select * from t2; +ERROR 42000: INSERT command denied to user 'mysqltest'@'localhost' for table 't7' +create table t4 select * from t2; +ERROR 42S01: Table 't4' already exists +create table t1 select * from t2; +ERROR 42000: INSERT command denied to user 'mysqltest'@'localhost' for table 't1' +drop table t1,t2,t4,t5,t6; +revoke create on mysqltest.* from mysqltest@localhost; +revoke select, insert on mysqltest.t2 from mysqltest@localhost; +revoke insert on mysqltest.t4 from mysqltest@localhost; +revoke create, insert on mysqltest.t5 from mysqltest@localhost; +revoke create, insert on mysqltest.t6 from mysqltest@localhost; +flush privileges; +drop database mysqltest; +use test; diff --git a/mysql-test/r/grant.result b/mysql-test/r/grant.result index 4e4e2ccff48..2f457a4acbc 100644 --- a/mysql-test/r/grant.result +++ b/mysql-test/r/grant.result @@ -349,12 +349,12 @@ show grants for grant_user@localhost; Grants for grant_user@localhost GRANT USAGE ON *.* TO 'grant_user'@'localhost' GRANT INSERT (a, d, c, b) ON `test`.`t1` TO 'grant_user'@'localhost' -select Host,Db,User,Table_name,Column_name,Column_priv from mysql.columns_priv; +select Host,Db,User,Table_name,Column_name,Column_priv from mysql.columns_priv order by Column_name; Host Db User Table_name Column_name Column_priv -localhost test grant_user t1 b Insert -localhost test grant_user t1 d Insert localhost test grant_user t1 a Insert +localhost test grant_user t1 b Insert localhost test grant_user t1 c Insert +localhost test grant_user t1 d Insert revoke ALL PRIVILEGES on t1 from grant_user@localhost; show grants for grant_user@localhost; Grants for grant_user@localhost diff --git a/mysql-test/t/create.test b/mysql-test/t/create.test index 57b16a13c01..d54615ddb4d 100644 --- a/mysql-test/t/create.test +++ b/mysql-test/t/create.test @@ -609,4 +609,80 @@ drop table t1, t2; --error 1105 create table t1(a set("a,b","c,d") not null); +# +# Bug #20901 - CREATE privilege is enough to insert into a table +# + +create database mysqltest; +use mysqltest; + +grant create on mysqltest.* to mysqltest@localhost; +create table t1 (i INT); + +connect (user1,localhost,mysqltest,,mysqltest); +connection user1; +# show we don't have INSERT +--error 1044 +insert into t1 values (1); +# show we have CREATE +create table t2 (i INT); +create table t4 (i INT); + +connection default; +grant select, insert on mysqltest.t2 to mysqltest@localhost; +grant insert on mysqltest.t4 to mysqltest@localhost; +# to specify ACLs for non-existent objects, must explictly |CREATE +grant create, insert on mysqltest.t5 to mysqltest@localhost; +grant create, insert on mysqltest.t6 to mysqltest@localhost; +flush privileges; + +connection user1; +insert into t2 values (1); + + +# CREATE IF NOT EXISTS...SELECT, t1 exists, no INSERT, must fail +--error 1142 +create table if not exists t1 select * from t2; + +# CREATE IF NOT EXISTS...SELECT, no t3 yet, no INSERT, must fail +--error 1142 +create table if not exists t3 select * from t2; + +# CREATE IF NOT EXISTS...SELECT, t4 exists, have INSERT, must succeed +create table if not exists t4 select * from t2; + +# CREATE IF NOT EXISTS...SELECT, no t5 yet, have INSERT, must succeed +create table if not exists t5 select * from t2; + + +# CREATE...SELECT, no t6 yet, have INSERT, must succeed +create table t6 select * from t2; + +# CREATE...SELECT, no t7 yet, no INSERT, must fail +--error 1142 +create table t7 select * from t2; + +# CREATE...SELECT, t4 exists, have INSERT, must still fail (exists) +--error 1050 +create table t4 select * from t2; + +# CREATE...SELECT, t1 exists, no INSERT, must fail +--error 1142 +create table t1 select * from t2; + + +connection default; +drop table t1,t2,t4,t5,t6; + +revoke create on mysqltest.* from mysqltest@localhost; +revoke select, insert on mysqltest.t2 from mysqltest@localhost; +revoke insert on mysqltest.t4 from mysqltest@localhost; +revoke create, insert on mysqltest.t5 from mysqltest@localhost; +revoke create, insert on mysqltest.t6 from mysqltest@localhost; +flush privileges; + +disconnect user1; +drop database mysqltest; +use test; + # End of 4.1 tests diff --git a/mysql-test/t/grant.test b/mysql-test/t/grant.test index ea148c67262..dcdf3f6f4e0 100644 --- a/mysql-test/t/grant.test +++ b/mysql-test/t/grant.test @@ -296,7 +296,7 @@ DROP DATABASE testdb10; create table t1(a int, b int, c int, d int); grant insert(b), insert(c), insert(d), insert(a) on t1 to grant_user@localhost; show grants for grant_user@localhost; -select Host,Db,User,Table_name,Column_name,Column_priv from mysql.columns_priv; +select Host,Db,User,Table_name,Column_name,Column_priv from mysql.columns_priv order by Column_name; revoke ALL PRIVILEGES on t1 from grant_user@localhost; show grants for grant_user@localhost; select Host,Db,User,Table_name,Column_name,Column_priv from mysql.columns_priv; diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc index 24f9ef30569..880a145903c 100644 --- a/sql/sql_parse.cc +++ b/sql/sql_parse.cc @@ -5832,8 +5832,15 @@ int create_table_precheck(THD *thd, TABLE_LIST *tables, int error= 1; // Error message is given DBUG_ENTER("create_table_precheck"); + /* + Require CREATE [TEMPORARY] privilege on new table; for + CREATE TABLE ... SELECT, also require INSERT. + */ + want_priv= ((lex->create_info.options & HA_LEX_CREATE_TMP_TABLE) ? - CREATE_TMP_ACL : CREATE_ACL); + CREATE_TMP_ACL : CREATE_ACL) | + (select_lex->item_list.elements ? INSERT_ACL : 0); + if (check_access(thd, want_priv, create_table->db, &create_table->grant.privilege, 0, 0) || check_merge_table_access(thd, create_table->db, From d4e4be8ad5ae3e717f31ebffae3f474586a753de Mon Sep 17 00:00:00 2001 From: unknown Date: Tue, 23 Oct 2007 07:09:16 +0200 Subject: [PATCH 2/2] Bug #20901: CREATE privilege is enough to insert into a table CREATE TABLE IF NOT EXISTS ... SELECT let you insert into an existing table as long as you had the CREATE privilege. CREATE ... SELECT variants now always require INSERT privilege on target table. mysql-test/r/create.result: after-merge fixes, errno changed 4.1->5.0 mysql-test/t/create.test: after-merge fixes, errno changed 4.1->5.0 --- mysql-test/r/create.result | 2 +- mysql-test/t/create.test | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/mysql-test/r/create.result b/mysql-test/r/create.result index 006dc951297..daafaa1a45a 100644 --- a/mysql-test/r/create.result +++ b/mysql-test/r/create.result @@ -755,7 +755,7 @@ use mysqltest; grant create on mysqltest.* to mysqltest@localhost; create table t1 (i INT); insert into t1 values (1); -ERROR 42000: Access denied for user 'mysqltest'@'localhost' to database 'mysqltest' +ERROR 42000: INSERT command denied to user 'mysqltest'@'localhost' for table 't1' create table t2 (i INT); create table t4 (i INT); grant select, insert on mysqltest.t2 to mysqltest@localhost; diff --git a/mysql-test/t/create.test b/mysql-test/t/create.test index 106ecbb2586..8d76787de5a 100644 --- a/mysql-test/t/create.test +++ b/mysql-test/t/create.test @@ -667,7 +667,7 @@ create table t1 (i INT); connect (user1,localhost,mysqltest,,mysqltest); connection user1; # show we don't have INSERT ---error 1044 +--error 1142 insert into t1 values (1); # show we have CREATE create table t2 (i INT);