Commit graph

198 commits

Author SHA1 Message Date
Sergei Golubchik
b4a0b2c2f8 post-merge fixes.
most tests pass.
5.3 merge is next
2011-07-02 22:12:12 +02:00
Sergei Golubchik
9809f05199 5.5-merge 2011-07-02 22:08:51 +02:00
Sergei Golubchik
0accbd0364 lots of post-merge changes 2011-04-25 17:22:25 +02:00
Georgi Kodinov
dd0823cc03 Bug # 11766011: mysql.user.authentication_string column causes
configuration wizard to fail

Made the fields mysql.user.plugin and mysql.user.authentication_string
nullable to conform with some older clients doing inserts instead of 
using the commands.
2011-03-18 16:16:17 +02:00
Georgi Kodinov
01f218e896 merge mysql-5.1->mysql-5.5 2011-03-09 16:04:50 +02:00
Dmitry Lenev
f74fd118cf Merged fix for bug #36544 "DROP USER does not remove stored
function privileges" into 5.5 tree. Did after-merge fixes.
2011-02-07 15:06:22 +03:00
Dmitry Lenev
b169b8d853 Fix for bug#36544 "DROP USER does not remove stored function
privileges".

The first problem was that DROP USER didn't properly remove privileges 
on stored functions from in-memory structures. So the dropped user
could have called stored functions on which he had privileges before
being dropped while his connection was still around.
Even worse if a new user with the same name was created he would
inherit privileges on stored functions from the dropped user.
Similar thing happened with old user name and function privileges
during RENAME USER.

This problem stemmed from the fact that the handle_grant_data() function
which handled DROP/RENAME USER didn't take any measures to update
in-memory hash with information about function privileges after
updating them on disk.

This patch solves this problem by adding code doing just that.

The second problem was that RENAME USER didn't properly update in-memory
structures describing table-level privileges and privileges on stored 
procedures. As result such privileges could have been lost after a rename
(i.e. not associated with the new name of user) and inherited by a new
user with the same name as the old name of the original user.

This problem was caused by code handling RENAME USER in
handle_grant_struct() which [sic!]:
a) tried to update wrong (tables) hash when updating stored procedure
   privileges for new user name.
b) passed wrong arguments to function performing the hash update and
   didn't take into account the way in which such update could have
   changed the order of the hash elements.

This patch solves this problem by ensuring that a) the correct hash
is updated, b) correct arguments are used for the hash_update()
function and c) we take into account possible changes in the order
of hash elements.

mysql-test/r/grant.result:
  Added test coverage for bug#36544 "DROP USER does not remove stored
  function privileges".
mysql-test/suite/funcs_1/r/innodb_storedproc_06.result:
  Since after fixing bug#36544 "DROP USER does not remove stored function
  privileges" in-memory structures are correctly updated by DROP USER,
  DROP FUNCTION performed after DROP USER for its definer no longer
  produces unwarranted warning/error messages.
mysql-test/suite/funcs_1/r/memory_storedproc_06.result:
  Since after fixing bug#36544 "DROP USER does not remove stored function
  privileges" in-memory structures are correctly updated by DROP USER,
  DROP FUNCTION performed after DROP USER for its definer no longer
  produces unwarranted warning/error messages.
mysql-test/suite/funcs_1/r/myisam_storedproc_06.result:
  Since after fixing bug#36544 "DROP USER does not remove stored function
  privileges" in-memory structures are correctly updated by DROP USER,
  DROP FUNCTION performed after DROP USER for its definer no longer
  produces unwarranted warning/error messages.
mysql-test/t/grant.test:
  Added test coverage for bug#36544 "DROP USER does not remove stored
  function privileges".
sql/sql_acl.cc:
  Changed handle_grant_data() to also update hash with function 
  privileges. This allows DROP/RENAME USER correctly keep this 
  in-memory structure up-to-date.
  
  To do this extended handle_grant_struct() to support updating of this
  hash. In addition fixed code in this function which is responsible for 
  handling of column and routine hashes during RENAME USER, ensured that
  we correctly update these hashes after changing user name and that we
  don't skip elements while iterating through the hash and doing updates.
2011-02-07 14:01:19 +03:00
Jonathan Perkin
f13788c9fd Merge from mysql-5.5.9-release 2011-02-08 14:59:03 +01:00
Georgi Kodinov
60353d7eb6 Bug #59275: SHOW PRIVILEGES doesn't have an entry for the PROXY privilege
Added the privilege to the SHOW command.
2011-01-14 16:57:13 +02:00
Alexander Nozdrin
cf07f91ea4 Auto-merge from mysql-5.1-security. 2010-12-15 19:15:40 +03:00
Alexander Nozdrin
0c2ef4a63d Auto-merge from mysql-5.0-security. 2010-12-15 19:08:21 +03:00
Alexander Nozdrin
1bd81f6b81 Patch for Bug#57952 (privilege change is not taken into account by EXECUTE).
The user-visible problem was that changes to column-level privileges,
happened in between of PREPARE and EXECUTE of a prepared statement, were
neglected. I.e. a prepared statement could be executed with the
column-level privileges as of PREPARE-time. The problem existed for
column-level privileges only.

A similar problem existed for stored programs: the changes between
executions didn't have an effect.

Technically the thing is that table references are cached in
Prepared_statement::prepare() call. In subsequent
Prepared_statement::execute() calls those cached values are used.
There are two functions to get a field by name: find_field_in_table() and
find_field_in_table_ref(). On prepare-phase find_field_in_table_ref() is
called, on execute-phase -- find_field_in_table() because the table is
cached. find_field_in_table() does not check column-level privileges and
expects the caller to do that. The problem was that this check was
forgotten.

The fix is to check them there as it happens in find_field_in_table_ref().
2010-12-15 19:00:01 +03:00
Sergei Golubchik
65ca700def merge.
checkpoint.
does not compile.
2010-11-25 18:17:28 +01:00
Jon Olav Hauglid
8f73bddc9a Merge from mysql-5.5-bugteam to mysql-5.5-runtime
No conflicts
2010-10-19 11:26:45 +02:00
Dmitry Shulga
333434d23b Auto-merge from mysql-5.1-bugteam for bug#36742. 2010-10-13 13:27:03 +07:00
Dmitry Shulga
8169faec27 Fixed bug#36742 - GRANT hostname case handling inconsistent.
mysql-test/r/grant.result:
  It was added result for test case for bug#36742.
mysql-test/t/grant.test:
  It was added test case for bug#36742.
sql/sql_yacc.yy:
  It was added convertation of host name part of user name to lowercase.
2010-10-13 12:28:58 +07:00
Dmitry Lenev
eaae675279 Fix for bug#57061 "User without privilege on routine can
discover its existence".

The problem was that user without any privileges on 
routine was able to find out whether it existed or not.
DROP FUNCTION and DROP PROCEDURE statements were 
checking if routine being dropped existed and reported 
ER_SP_DOES_NOT_EXIST error/warning before checking 
if user had enough privileges to drop it.

This patch solves this problem by changing code not to 
check if routine exists before checking if user has enough 
privileges to drop it. Moreover we no longer perform this 
check using a separate call instead we rely on 
sp_drop_routine() returning SP_KEY_NOT_FOUND if routine 
doesn't exist.

This change also simplifies one of upcoming patches
refactoring global read lock implementation.

mysql-test/r/grant.result:
  Updated test case after fixing bug#57061 "User without
  privilege on routine can discover its existence". Removed
  DROP PROCEDURE/FUNCTION statements which have started to
  fail after this fix (correctly). There is no need in
  dropping routines in freshly created database anyway.
mysql-test/r/sp-security.result:
  Added new test case for bug#57061 "User without privilege
  on routine can discover its existence". Updated existing
  tests according to new behaviour.
mysql-test/suite/funcs_1/r/innodb_storedproc_06.result:
  Updated test case after fixing bug#57061 "User without
  privilege on routine can discover its existence".
  Now we drop routines under user which has enough
  privileges to do so.
mysql-test/suite/funcs_1/r/memory_storedproc_06.result:
  Updated test case after fixing bug#57061 "User without
  privilege on routine can discover its existence".
  Now we drop routines under user which has enough
  privileges to do so.
mysql-test/suite/funcs_1/r/myisam_storedproc_06.result:
  Updated test case after fixing bug#57061 "User without
  privilege on routine can discover its existence".
  Now we drop routines under user which has enough
  privileges to do so.
mysql-test/suite/funcs_1/storedproc/storedproc_06.inc:
  Updated test case after fixing bug#57061 "User without
  privilege on routine can discover its existence".
  Now we drop routines under user which has enough
  privileges to do so.
mysql-test/t/grant.test:
  Updated test case after fixing bug#57061 "User without
  privilege on routine can discover its existence". Removed
  DROP PROCEDURE/FUNCTION statements which have started to
  fail after this fix (correctly). There is no need in
  dropping routines in freshly created database anyway.
mysql-test/t/sp-security.test:
  Added new test case for bug#57061 "User without privilege
  on routine can discover its existence". Updated existing
  tests according to new behaviour.
sql/sp.cc:
  Removed sp_routine_exists_in_table() which is no longer
  used.
sql/sp.h:
  Removed sp_routine_exists_in_table() which is no longer
  used.
sql/sql_parse.cc:
  When dropping routine we no longer check if routine exists 
  before checking if user has enough privileges to do so. 
  Moreover we no longer perform this check using a separate 
  call instead we rely on sp_drop_routine() returning 
  SP_KEY_NOT_FOUND if routine doesn't exist.
2010-10-07 20:01:17 +04:00
Sergei Golubchik
a3d80d952d merge with 5.1 2010-09-11 20:43:48 +02:00
Michael Widenius
a4fff491eb Fix that one can run mysql_upgrade with long table names
Fall back to use ALTER TABLE for engines that doesn't support REPAIR when doing repair for upgrade.
Nicer output from mysql_upgrade and mysql_check
Updated all arrays that used NAME_LEN to use SAFE_NAME_LEN to ensure that we don't break things accidently as names can now have a #mysql50# prefix.

client/mysql_upgrade.c:
  If we are using verbose, also run mysqlcheck in verbose mode.
client/mysqlcheck.c:
  Add more information if running in verbose mode
  Print 'Needs upgrade' instead of complex error if table needs to be upgraded
  Don't write connect information if verbose is not 2 or above
mysql-test/r/drop.result:
  Updated test and results as we now support full table names
mysql-test/r/grant.result:
  Now you get a correct error message if using #mysql with paths
mysql-test/r/show_check.result:
  Update results as table names can temporarly be bigger than NAME_LEN (during upgrade)
mysql-test/r/upgrade.result:
  Test upgrade for long table names.
mysql-test/suite/funcs_1/r/is_tables_is.result:
  Updated old test result (had note been updated in a while)
mysql-test/t/drop.test:
  Updated test and results as we now support full table names
mysql-test/t/grant.test:
  Now you get a correct error message if using #mysql with paths
mysql-test/t/upgrade.test:
  Test upgrade for long table names.
sql/ha_partition.cc:
  NAME_LEN -> SAFE_NAME_LEN
sql/item.cc:
  NAME_LEN -> SAFE_NAME_LEN
sql/log_event.cc:
  NAME_LEN -> SAFE_NAME_LEN
sql/mysql_priv.h:
  Added SAFE_NAME_LEN
sql/rpl_filter.cc:
  NAME_LEN -> SAFE_NAME_LEN
sql/sp.cc:
  NAME_LEN -> SAFE_NAME_LEN
sql/sp_head.cc:
  NAME_LEN -> SAFE_NAME_LEN
sql/sql_acl.cc:
  NAME_LEN -> SAFE_NAME_LEN
sql/sql_base.cc:
  NAME_LEN -> SAFE_NAME_LEN
sql/sql_connect.cc:
  NAME_LEN -> SAFE_NAME_LEN
sql/sql_parse.cc:
  NAME_LEN -> SAFE_NAME_LEN
sql/sql_prepare.cc:
  NAME_LEN -> SAFE_NAME_LEN
sql/sql_select.cc:
  NAME_LEN -> SAFE_NAME_LEN
sql/sql_show.cc:
  NAME_LEN -> SAFE_NAME_LEN
  Enlarge table names for SHOW TABLES to also include optional #mysql50#
sql/sql_table.cc:
  Fall back to use ALTER TABLE for engines that doesn't support REPAIR when doing repair for upgrade.
sql/sql_trigger.cc:
  NAME_LEN -> SAFE_NAME_LEN
sql/sql_udf.cc:
  NAME_LEN -> SAFE_NAME_LEN
sql/sql_view.cc:
  NAME_LEN -> SAFE_NAME_LEN
sql/table.cc:
  Fixed check_table_name() to not count #mysql50# as part of name
  If #mysql50# is part of the name, don't allow path characters in name.
2010-09-03 19:20:30 +03:00
Georgi Kodinov
9705711596 WL#1054: Pluggable authentication support
Merged the implementation to a new base tree.
2010-08-09 11:32:50 +03:00
Sergei Golubchik
38b3218c4d merged 2010-05-15 14:44:06 +02:00
unknown
fcfb218f71 Cherry-pick fix for Bug#53371, security hole with bypassing grants using special path in db/table names.
Bump MariaDB version for security fix release.
2010-05-09 21:30:06 +02:00
Alexey Kopytov
5ef2bdea81 Manual merge of mysql-5.1-bugteam to mysql-trunk-merge.
Conflicts:

Text conflict in mysql-test/r/grant.result
Text conflict in mysql-test/t/grant.test
Text conflict in mysys/mf_loadpath.c
Text conflict in sql/slave.cc
Text conflict in sql/sql_priv.h
2010-05-09 02:03:35 +04:00
Georgi Kodinov
71b453fa06 Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants.
This is the 5.1 merge and extension of the fix.
The server was happily accepting paths in table name in all places a table
name is accepted (e.g. a SELECT). This allowed all users that have some 
privilege over some database to read all tables in all databases in all
mysql server instances that the server file system has access to.
Fixed by :
1. making sure no path elements are allowed in quoted table name when
constructing the path (note that the path symbols are still valid in table names
when they're properly escaped by the server).
2. checking the #mysql50# prefixed names the same way they're checked for
path elements in mysql-5.0.
2010-05-04 17:03:28 +03:00
Sergei Golubchik
291fd96983 pluggable auth with plugin examples
Makefile.am:
  add new API files to the check_abi rule,
  remove duplicates
client/CMakeLists.txt:
  now a client can use dlopen too
client/Makefile.am:
  be csh-friendly
include/my_global.h:
  add dummy plugs for dlopen and co.
  for the code that needs them to work in static builds
mysys/Makefile.am:
  be csh-friendly
plugin/auth/dialog.c:
  typo fixed
2010-03-29 17:13:53 +02:00
Marc Alff
e96932f49e Bug#31767 DROP FUNCTION name resolution
Backport to 5.5.99
2010-02-23 11:43:26 -07:00
Michael Widenius
4847e50ddb Changed version number from RC to stable
Fixed bug in Yassle to get correct error messages in case of errors
Provide better error messages in case of ssl connect failure
Updated out-of-date ssl certificates to fix failing mysql-test-system (certificates now active for 10 years)
Fixed bug in query_cache that could cause asserts and hangs in DEBUG builds.
Fixed bug where one connection did not see changes done by another connection.

configure.in:
  Changed version number from RC to stable
extra/yassl/src/yassl_error.cpp:
  Fixed bug in Yassle to get correct error messages in case of errors
  - 'error' is an enum that hold more error numbers than the enum was defined for
include/violite.h:
  Added error output string for sslaccept() and sslconnect() to get reason for connect failure
mysql-test/mysql-test-run.pl:
  Write failed test cases if mysql-test-run fails because of too many errors
mysql-test/r/grant.result:
  Update results to reflect new certificates
mysql-test/r/openssl_1.result:
  Update results to reflect new certificates
mysql-test/std_data/cacert.pem:
  Update ssl certificate
mysql-test/std_data/client-cert.pem:
  Update ssl certificate
mysql-test/std_data/client-key.pem:
  Update ssl certificate
mysql-test/std_data/server-cert.pem:
  Update ssl certificate
mysql-test/std_data/server-key.pem:
  Update ssl certificate
mysql-test/t/grant.test:
  Update test to reflect new certificates
mysql-test/t/openssl_1.test:
  Update test to reflect new certificates
mysql-test/t/query_cache_debug.test:
  Remove 'big_test' as test is now fast
sql-common/client.c:
  Give a better error message if ssl connect fails
sql/net_serv.cc:
  Fixed compiler warnings
sql/slave.cc:
  Give a better error message in logs if ssl connect fails
sql/sql_cache.cc:
  debug_wait_for_kill() now removes the set watch variable after kill signal
  This is needed as invalidate_table() may be called twice for one query.
  Ensure that net->query_cache_query is reset after query. This fixes assert in
  query_cache_end_of_result() if query_cache_query holds results from previous query.
  Removed DBUG_ASSERT(0), as this code can be run by query_cache_debug.test
sql/sql_connect.cc:
  Give a better error message if ssl connect fails
sql/sql_parse.cc:
  Fixed bug where one connection did not see changes done by another connection.
  For statements that changes tables, close_thread_tables() MUST be called before
  sending OK as a table handler may not make the changes available for other connections
  before unlock_tables().
vio/viossl.c:
  Give a better error message if ssl connect fails
2010-01-29 12:42:31 +02:00
Alexander Nozdrin
7cd11f45be Manual merge from mysql-trunk-merge. 2009-11-06 17:20:27 +03:00
Alexander Nozdrin
a708ba6524 Manual merge from mysql-next-mr. 2009-11-02 14:10:04 +03:00
Sergey Glukhov
f554a3c094 5.0-bugteam->5.1-bugteam merge 2009-10-27 14:09:36 +04:00
Sergey Glukhov
795102b786 Bug#35427 INFORMATION_SCHEMA.TABLES.TABLE_CATALOG is NULL, should be "def"
backport to betony
2009-10-23 16:02:20 +05:00
Alexander Nozdrin
720252532f Backporting patches for Bug#38347 (ALTER ROUTINE privilege
allows SHOW CREATE TABLE) from 6.0. Original revisions:
------------------------------------------------------------
revno: 2617.31.8
committer: Alexander Nozdrin <alik@sun.com>
branch nick: 6.0-rt-bug38347
timestamp: Thu 2009-03-26 09:08:24 +0300
message:
  Patch for Bug#38347: ALTER ROUTINE privilege allows SHOW CREATE TABLE.
  
  If a user has any of the following privileges for a table (or the database
  if the table), he should be able to issue SHOW CREATE TABLE for the table:
    - CREATE
    - DROP
    - ALTER
    - DELETE
    - INDEX
    - INSERT
    - SELECT
    - UPDATE
    - TRIGGER
    - REFERENCES
    - GRANT OPTION
    - CREATE VIEW
    - SHOW VIEW
  
  Any other privilege (even SUPER) should not allow SHOW CREATE TABLE.
------------------------------------------------------------
revno: 2617.31.11
committer: Alexander Nozdrin <alik@sun.com>
branch nick: 6.0-rt
timestamp: Fri 2009-03-27 21:36:34 +0300
message:
  Additional patch for Bug#38347 (ALTER ROUTINE privilege
  allows SHOW CREATE TABLE).
  
  The problem was that information_schema.test,
  information_schema_parameters.test and information_schema_routines.test
  failed with the first patch. That happened due to limitation in check_access():
  it allows only SELECT_ACL privilege for INFORMATION_SCHEMA tables.
  
  The patch is to request only SELECT_ACL privilege for INFORMATION_SCHEMA tables.
------------------------------------------------------------
2009-10-22 16:51:51 +04:00
Kristofer Pettersson
d1b03b432f Automerge 2009-10-19 15:00:38 +02:00
Kristofer Pettersson
0659b857e7 Bug#27145 EXTRA_ACL troubles
The flag EXTRA_ACL is used in conjugation with our access checks, yet it is
not clear what impact this flag has.
This is a code clean up which replaces use of EXTRA_ACL with an explicit
function parameter.
The patch also fixes privilege checks for:
- SHOW CREATE TABLE: The new privilege requirement is any privilege on
  the table-level.
- CHECKSUM TABLE: Requires SELECT on the table level.
- SHOW CREATE VIEW: Requires SHOW_VIEW and SELECT on the table level
  (just as the manual claims)
- SHOW INDEX: Requires any privilege on any column combination.


mysql-test/r/grant.result:
  * Error message now shows correct command (SHOW instead of SELECT)
mysql-test/r/grant2.result:
  * Error message now shows correct command (SHOW instead of SELECT)
mysql-test/r/grant4.result:
  * This test file tests privilege requirements for
    SHOW COLUMNS
    CREATE TABLE .. LIKE
    SHOW CREATE TABLE
    SHOW INDEX
    CHECKSUM TABLE
    SHOW CREATE VIEW
mysql-test/r/information_schema_db.result:
  * Added SELECT privilege to testdb_2 as
    SHOW CREATE VIEW now demands this privilege
    as well as SHOW VIEW.
mysql-test/r/outfile.result:
  * Changed error code
mysql-test/r/view_grant.result:
  * Additional SELECT privilege is now needed
    for SHOW CREATE VIEW
mysql-test/t/grant4.test:
  * This test file tests privilege requirements for
    SHOW COLUMNS
    CREATE TABLE .. LIKE
    SHOW CREATE TABLE
    SHOW INDEX
    CHECKSUM TABLE
    SHOW CREATE VIEW
mysql-test/t/information_schema_db.test:
  * Added SELECT privilege to testdb_2 as
    SHOW CREATE VIEW now demands this privilege
    as well as SHOW VIEW.
mysql-test/t/outfile.test:
  * Changed error code
mysql-test/t/view_grant.test:
  * Additional SELECT privilege is now needed
    for SHOW CREATE VIEW
sql/mysql_priv.h:
  * Replaced EXTRA_ACL with a parameter
sql/sp_head.cc:
  * Replaced EXTRA_ACL with a parameter
sql/sql_acl.cc:
  * Converted function documentation to doxygen and clarified some behaviors.
  * Changed value from uint to bool to better reflect its meaning.
  * Removed pointless variable orig_want_access
  * Added function has_any_table_level_privileges to help with requirements
    checks during SHOW CREATE TABLE.
sql/sql_acl.h:
  * changed signature of check_grant()
  * introduced access control function has_any_table_leevl_privileges()
sql/sql_base.cc:
  * Check_table_access has new signature
sql/sql_cache.cc:
  * Check_table_access has new signature
sql/sql_parse.cc:
  * Rewrote function documentation in doxygen comments for: check_access,
    check_table_acces, check_grant.
  * Removed EXTRA_ACL flag where it doesn't hold any meaningful purpose anymore
    and replaced it with a function parameter where any privileges on any column
    combination would satisfy the requirement.
  * Fixed privilege check for SHOW COLUMNS and SHOW INDEX
  * Modified check_table_access to gain clarity in what EXTRA_ACL actually does.
  * Modified check_access to gain clarity in what EXTRA_ACL actually does.
  * Fixed privilege check for CREATE TABLE .. LIKE .. ; It now requires SELECT
    privileges on the table.
  * Fixed privilege check for SHOW CREATE TABLE ..; It now requires any privilege
    on the table level.
sql/sql_plugin.cc:
  * check_table_access has new signature
sql/sql_prepare.cc:
  * check_table_access has new signature
sql/sql_show.cc:
  * check_table_access has new signature
sql/sql_trigger.cc:
  * check_table_access has new signature
sql/sql_update.cc:
  * check grant has new signature
sql/sql_view.cc:
  * check_table_access has new signature
2009-10-19 14:58:13 +02:00
Alexander Nozdrin
13f09243e3 A backporting patch for WL#4300 (Define privileges for tablespaces).
Original revision in 6.0:
------------------------------------------------------------
revno: 2630.13.11
committer: Alexander Nozdrin <alik@mysql.com>
branch nick: 6.0-rt-wl4300
timestamp: Thu 2008-07-24 11:44:21 +0400
message:
  A patch for WL#4300: Define privileges for tablespaces.
------------------------------------------------------------

per-file messages:
  mysql-test/r/grant.result
    Update result file: new columm 'Create_tablespace_priv' has been added to mysql.user.
  mysql-test/r/ps.result
    Update result file: new columm 'Create_tablespace_priv' has been added to mysql.user.
  mysql-test/r/system_mysql_db.result
    Update result file: new columm 'Create_tablespace_priv' has been added to mysql.user.
  mysql-test/suite/falcon/r/falcon_tablespace_priv.result
    Test case for WL#4300.
  mysql-test/suite/falcon/t/falcon_tablespace_priv.test
    Test case for WL#4300.
  mysql-test/suite/ndb/r/ndb_dd_ddl.result
    Test case for WL#4300.
  mysql-test/suite/ndb/t/ndb_dd_ddl.test
    Test case for WL#4300.
  scripts/mysql_system_tables.sql
    New columm 'Create_tablespace_priv' has been added to mysql.user.
  scripts/mysql_system_tables_data.sql
    'CREATE TABLESPACE' is granted by default to the root user.
  scripts/mysql_system_tables_fix.sql
    Grant 'CREATE TABLESPACE' privilege during system table upgrade
    if a user had SUPER privilege.
  sql/sql_acl.cc
    Added CREATE TABLESPACE privilege.
  sql/sql_acl.h
    Added CREATE TABLESPACE privilege.
  sql/sql_parse.cc
    Check global 'CREATE TABLESPACE' privilege for the following SQL statements:
      - CREATE | ALTER | DROP TABLESPACE
      - CREATE | ALTER | DROP LOGFILE GROUP
  sql/sql_show.cc
    Added CREATE TABLESPACE privilege.
  sql/sql_yacc.yy
    Added CREATE TABLESPACE privilege.
2009-10-10 00:01:10 +04:00
Jon Olav Hauglid
4dae0e0307 Bug #25863 No database selected error, but documentation
says * for global allowed

The current behaviour of 'GRANT *' was changed as a part of the fix
for Bug#19022, Bug#17199 and Bug#18444. To avoid regression, we keep
the current behavior and update the documentation. 
Test case added to grant.test.
2009-10-09 11:57:55 +02:00
Kristofer Pettersson
66e0ee6639 Bug#44658 Create procedure makes server crash when user does not have ALL privilege
MySQL crashes if a user without proper privileges attempts to create a procedure.

The crash happens because more than one error state is pushed onto the Diagnostic
area. In this particular case the user is denied to implicitly create a new user
account with the implicitly granted privileges ALTER- and EXECUTE ROUTINE.

The new account is needed if the original user account contained a host mask.
A user account with a host mask is a distinct user account in this context.
An alternative would be to first get the most permissive user account which
include the current user connection and then assign privileges to that
account. This behavior change is considered out of scope for this bug patch.

The implicit assignment of privileges when a user creates a stored routine is a
considered to be a feature for user convenience and as such it is not
a critical operation. Any failure to complete this operation is thus considered
non-fatal (an error becomes a warning).

The patch back ports a stack implementation of the internal error handler interface.
This enables the use of multiple error handlers so that it is possible to intercept
and cancel errors thrown by lower layers. This is needed as a error handler already
is used in the call stack emitting the errors which needs to be converted.


mysql-test/r/grant.result:
  * Added test case for bug44658
mysql-test/t/grant.test:
  * Added test case for bug44658
sql/sp.cc:
  * Removed non functional parameter no_error and my_error calls as all errors
    from this function will be converted to a warning anyway.
  * Change function return type from int to bool.
sql/sp.h:
  * Removed non functional parameter no_error and my_error calls as all errors
    from this function will be converted to a warning anyway.
  * Changed function return value from int to bool
sql/sql_acl.cc:
  * Removed the non functional no_error parameter from the function prototype.
    The function is called from two places and in one of the places we now 
    ignore errors through error handlers.
  * Introduced the parameter write_to_binlog
  * Introduced an error handler to cancel any error state from mysql_routine_grant.
  * Moved my_ok() signal from mysql_routine_grant to make it easier to avoid
    setting the wrong state in the Diagnostic area.
  * Changed the broken error state in sp_grant_privileges() to a warning
    so that if "CREATE PROCEDURE" fails because "Password hash isn't a hexidecimal
    number" it is still clear what happened.
sql/sql_acl.h:
  * Removed the non functional no_error parameter from the function prototype.
    The function is called from two places and in one of the places we now 
    ignore errors through error handlers.
  * Introduced the parameter write_to_binlog
  * Changed return type for sp_grant_privileges() from int to bool
sql/sql_class.cc:
  * Back ported implementation of internal error handler from 6.0 branch
sql/sql_class.h:
  * Back ported implementation of internal error handler from 6.0 branch
sql/sql_parse.cc:
  * Moved my_ok() signal from mysql_routine_grant() to make it easier to avoid
    setting the wrong state in the Diagnostic area.
2009-05-29 15:37:54 +02:00
Sergey Glukhov
89fbca2813 5.0-bugteam->5.1-bugteam merge 2009-02-25 16:18:24 +04:00
Sergey Glukhov
2bc4ad4f1f Bug#30305 Create routine in wrong context in SHOW PRIVILEGES
Changed context of Create routine to Databases.


mysql-test/r/grant.result:
  result fix
mysql-test/r/sp.result:
  result fix
sql/sql_show.cc:
  Changed context of Create routine to Databases.
2009-02-25 14:20:20 +04:00
Matthias Leich
0ef6e2a5ab Merge 5.0 -> 5.1 2009-02-09 22:00:15 +01:00
Matthias Leich
41e6a1f89c 2. Slice of fix for Bug#42003 tests missing the disconnect of connections <> default
- If missing: add "disconnect <session>"
   - If physical disconnect of non "default" sessions is not finished
     at test end: add routine which waits till this happened
+ additional improvements
  - remove superfluous files created by the test
  - replace error numbers by error names
  - remove trailing spaces, replace tabs by spaces
  - unify writing of bugs within comments
  - correct comments
  - minor changes of formatting
Fixed tests:
  backup
  check
  compress
  grant
  information_schema
  multi_update
  overflow
  packet
  query_cache_not_embedded
  sp-threads
  subselect
  synchronization
  timezone_grant
2009-02-05 21:47:23 +01:00
Luis Soares
df8543868d merge: 5.1 -> 5.1-rpl
conflicts:
  Text conflict in client/mysqltest.cc
  Text conflict in mysql-test/include/wait_until_connected_again.inc
  Text conflict in mysql-test/lib/mtr_report.pm
  Text conflict in mysql-test/mysql-test-run.pl
  Text conflict in mysql-test/r/events_bugs.result
  Text conflict in mysql-test/r/log_state.result
  Text conflict in mysql-test/r/myisam_data_pointer_size_func.result
  Text conflict in mysql-test/r/mysqlcheck.result
  Text conflict in mysql-test/r/query_cache.result
  Text conflict in mysql-test/r/status.result
  Text conflict in mysql-test/suite/binlog/r/binlog_index.result
  Text conflict in mysql-test/suite/binlog/r/binlog_innodb.result
  Text conflict in mysql-test/suite/rpl/r/rpl_packet.result
  Text conflict in mysql-test/suite/rpl/t/rpl_packet.test
  Text conflict in mysql-test/t/disabled.def
  Text conflict in mysql-test/t/events_bugs.test
  Text conflict in mysql-test/t/log_state.test
  Text conflict in mysql-test/t/myisam_data_pointer_size_func.test
  Text conflict in mysql-test/t/mysqlcheck.test
  Text conflict in mysql-test/t/query_cache.test
  Text conflict in mysql-test/t/rpl_init_slave_func.test
  Text conflict in mysql-test/t/status.test
2009-01-23 13:22:05 +01:00
Sergey Glukhov
e75ba73a07 5.0-bugteam->5.1-bugteam merge 2008-12-24 19:16:50 +04:00
Sergey Glukhov
7103f4c916 Bug#41456 SET PASSWORD hates CURRENT_USER()
init user->user struct with 
thd->security_ctx->priv_user context
if user->user is not initializied

mysql-test/r/grant.result:
  test result
mysql-test/t/grant.test:
  test case
sql/set_var.cc:
  init user->user struct with 
  thd->security_ctx->priv_user context
  if user->user is not initializied
2008-12-24 19:14:59 +04:00
Sven Sandberg
6e69536956 BUG#37975: wait_for_slave_* should increase the timeout
Problem 1: tests often fail in pushbuild with a timeout when waiting
for the slave to start/stop/receive error.
Fix 1: Updated the wait_for_slave_* macros in the following way:
- The timeout is increased by a factor ten
- Refactored the macros so that wait_for_slave_param does the work for
the other macros.
Problem 2: Tests are often incorrectly written, lacking a
source include/wait_for_slave_to_[start|stop].inc.
Fix 2: Improved the chance to get it right by adding
include/start_slave.inc and include/stop_slave.inc, and updated tests
to use these.
Problem 3: The the built-in test language command
wait_for_slave_to_stop is a misnomer (does not wait for the slave io
thread) and does not give as much debug info in case of failure as
the otherwise equivalent macro
source include/wait_for_slave_sql_to_stop.inc
Fix 3: Replaced all calls to the built-in command by a call to the
macro.
Problem 4: Some, but not all, of the wait_for_slave_* macros had an
implicit connection slave. This made some tests confusing to read,
and made it more difficult to use the macro in circular replication
scenarios, where the connection named master needs to wait.
Fix 4: Removed the implicit connection slave from all
wait_for_slave_* macros, and updated tests to use an explicit
connection slave where necessary.
Problem 5: The macros wait_slave_status.inc and wait_show_pattern.inc
were unused. Moreover, using them is difficult and error-prone.
Fix 5: remove these macros.
Problem 6: log_bin_trust_function_creators_basic failed when running
tests because it assumed @@global.log_bin_trust_function_creators=1,
and some tests modified this variable without resetting it to its
original value.
Fix 6: All tests that use this variable have been updated so that
they reset the value at end of test.


mysql-test/extra/rpl_tests/rpl_extraMaster_Col.test:
  Replaced wait_for_slave_to_stop by include/wait_for_slave_sql_to_stop.inc
mysql-test/extra/rpl_tests/rpl_extraSlave_Col.test:
  Replaced wait_for_slave_to_stop by include/wait_for_slave_sql_to_stop.inc
  Added connection slave since includ/wait_for_slave_sql_to_stop.inc
  does not do that anymore.
mysql-test/extra/rpl_tests/rpl_log.test:
  Replaced start slave+wait_slave_status by start_slave.inc
mysql-test/include/reset_master_and_slave.inc:
  replaced start/stop slave by start_slave.inc/stop_slave.inc
mysql-test/include/sync_slave_io_with_master.inc:
  Improved comments and error message.
mysql-test/include/wait_for_slave_io_to_stop.inc:
  Refactored to use wait_for_slave_param.inc.
  Removed connection slave.
mysql-test/include/wait_for_slave_param.inc:
  - Improved usage instructions
  - Added more debug info in case of timeout
  - Added parameters $slave_param_comparison, $slave_timeout,
  $slave_keep_connection, $slave_error_message
mysql-test/include/wait_for_slave_sql_error.inc:
  Refactored to use wait_for_slave_param.inc.
  Removed connection slave.
mysql-test/include/wait_for_slave_sql_to_start.inc:
  Refactored to use wait_for_slave_param.inc.
  Removed connection slave.
mysql-test/include/wait_for_slave_sql_to_stop.inc:
  Refactored to use wait_for_slave_param.inc.
  Removed connection slave.
mysql-test/include/wait_for_slave_to_start.inc:
  Refactored to use wait_for_slave_param.inc.
  Removed connection slave.
mysql-test/include/wait_for_slave_to_stop.inc:
  Refactored to use wait_for_slave_param.inc.
  Removed connection slave.
mysql-test/include/wait_show_pattern.inc:
  Removed unused (and error-prone) file
mysql-test/include/wait_slave_status.inc:
  Removed unused (and error-prone) file
mysql-test/suite/binlog/t/binlog_auto_increment_bug33029.test:
  Renamed $keep_connection to $slave_keep_connection.
mysql-test/suite/rpl/t/rpl_bug26395.test:
  Replace stop slave by stop_slave.inc
mysql-test/suite/rpl/t/rpl_circular_for_4_hosts.test:
  Replace start/stop slave by start_slave.inc/stop_slave.inc.
  Replace wait_for_slave_param by wait_for_slave_sql_to_stop.inc.
mysql-test/suite/rpl/t/rpl_dual_pos_advance.test:
  Renamed $keep_connection to $slave_keep_connection.
mysql-test/suite/rpl/t/rpl_flushlog_loop.test:
  Replace wait_slave_status by start_slave.inc
mysql-test/suite/rpl/t/rpl_idempotency.test:
  Added connection slave since wait_for_slave_sql_to_stop.inc does not
  do that any more.
mysql-test/suite/rpl/t/rpl_incident.test:
  Replaced wait_for_slave_to_stop by wait_for_slave_sql_to_stop.inc
mysql-test/suite/rpl/t/rpl_init_slave.test:
  Replaced start/stop slave by start_slave.inc/stop_slave.inc.
  Replaced save_master_pos;connection slave;sync_with_master by
  sync_slave_with_master.
mysql-test/suite/rpl/t/rpl_log_pos.test:
  Replaced start/stop slave by start_slave.inc/stop_slave.inc.
  Replaced wait_for_slave_param by other wait_for_slave_* macros.
mysql-test/suite/rpl/t/rpl_packet.test:
  Replaced start/stop slave by start_slave.inc/stop_slave.inc.
mysql-test/suite/rpl/t/rpl_row_inexist_tbl.test:
  Replaced start/stop slave by start_slave.inc/stop_slave.inc.
mysql-test/suite/rpl/t/rpl_row_stop_middle_update.test:
  Replaced start/stop slave by start_slave.inc/stop_slave.inc.
mysql-test/suite/rpl/t/rpl_row_until.test:
  Replaced start/stop slave by start_slave.inc/stop_slave.inc.
  Replaced save_master_pos;connection slave;sync_with_master by
  sync_slave_with_master.
mysql-test/suite/rpl/t/rpl_server_id1.test:
  Replaced start/stop slave by start_slave.inc/stop_slave.inc.
mysql-test/suite/rpl/t/rpl_slave_grp_exec.test:
  Replaced start/stop slave by start_slave.inc/stop_slave.inc.
mysql-test/suite/rpl/t/rpl_slave_skip.test:
  Replaced start/stop slave by start_slave.inc/stop_slave.inc.
mysql-test/suite/rpl/t/rpl_slave_status.test:
  Replaced start/stop slave by start_slave.inc/stop_slave.inc.
mysql-test/suite/rpl/t/rpl_sp.test:
  Restore @@global.log_bin_trust_function_creators at end of test.
mysql-test/suite/rpl/t/rpl_sp_effects.test:
  Restore @@global.log_bin_trust_function_creators at end of test.
mysql-test/suite/rpl/t/rpl_stm_until.test:
  Replaced start/stop slave by start_slave.inc/stop_slave.inc.
  Replaced save_master_pos;connection slave;sync_with_master by
  sync_slave_with_master.
mysql-test/suite/rpl_ndb/t/rpl_ndb_basic.test:
  Replaced start slave by start_slave.inc.
  Added explicit connection slave since wait_for_slave_sql_to_stop.inc
  does not do that anymore.
mysql-test/t/disabled.def:
  Disabled failing test.
mysql-test/t/func_time.test:
  Restore @@global.log_bin_trust_function_creators at end of test.
mysql-test/t/grant.test:
  Restore @@global.log_bin_trust_function_creators at end of test.
mysql-test/t/grant2.test:
  Restore @@global.log_bin_trust_function_creators at end of test.
mysql-test/t/innodb_notembedded.test:
  Restore @@global.log_bin_trust_function_creators at end of test.
mysql-test/t/log_bin_trust_function_creators_func.test:
  Restore @@global.log_bin_trust_function_creators at end of test.
  Clean up at end of test by dropping the created user.
mysql-test/t/query_cache.test:
  Restore @@global.log_bin_trust_function_creators at end of test.
mysql-test/t/query_cache_notembedded.test:
  Restore @@global.log_bin_trust_function_creators at end of test.
mysql-test/t/rpl_init_slave_func.test:
  Replaced start/stop slave by start_slave.inc/stop_slave.inc.
mysql-test/t/timezone2.test:
  Restore @@global.log_bin_trust_function_creators at end of test.
2008-07-10 18:09:39 +02:00
unknown
1abfb6e040 Merge quad.opbmk:/mnt/raid/alik/MySQL/devel/5.1
into  quad.opbmk:/mnt/raid/alik/MySQL/devel/5.1-rt-merged


mysql-test/r/grant.result:
  Auto merged
mysql-test/t/grant.test:
  Auto merged
sql/sql_acl.cc:
  Auto merged
2008-03-28 14:40:11 +03:00
unknown
f8653a79e9 Patch clean up.
Fixed interference between tests: Users were added but not properly removed.
This caused later tests to fail.


mysql-test/r/grant.result:
  Fixed interference between tests: Users were added but not properly removed.
  This caused later tests to fail.
mysql-test/t/grant.test:
  Fixed interference between tests: Users were added but not properly removed.
  This caused later tests to fail.
2008-03-27 09:37:20 -03:00
unknown
266fc6121b Corrected result-file merge error. 2008-03-26 14:03:01 +01:00
unknown
f6d51ae79f Merge zippy.cornsilk.net:/home/cmiller/work/mysql/bug#33464/my51-bug#33464
into  zippy.cornsilk.net:/home/cmiller/work/mysql/mysql-5.1-build


mysql-test/r/grant.result:
  Auto merged
mysql-test/t/grant.test:
  Auto merged
2008-03-05 14:22:52 -05:00
unknown
2eb6790870 Move test that has more to do with grants than DROP. We shouldn't have
grant warnings on embedded server.


mysql-test/r/drop.result:
  Move test that has more to do with grants than DROP.
mysql-test/r/grant.result:
  Move test that has more to do with grants than DROP.
mysql-test/t/drop.test:
  Move test that has more to do with grants than DROP.
mysql-test/t/grant.test:
  Move test that has more to do with grants than DROP.
2008-03-05 14:18:35 -05:00