mariadb/mysql-test/suite/sql_sequence/view.test
Sergei Golubchik f99586668a MDEV-36380 User has unauthorized access to a sequence through a view with security invoker
check sequence privileges in Item_func_nextval::fix_fields(),
just like column privileges are checked in Item_field::fix_fields()

remove sequence specific hacks that kinda made sequence privilege
checks works, but not in all cases. And they were too lax,
didn't requre SELECT privilege for NEXTVAL. Also INSERT privilege looks
wrong here, UPDATE would've been more appropriate, but won't
change that for compatibility reasons.

also fixes

MDEV-36413 User without any privileges to a sequence can read from it and modify it via column default
2025-04-17 17:18:55 +02:00

41 lines
936 B
Text

--source include/have_sequence.inc
#
# Test sequences with views
#
create sequence s1;
create view v1 as select * from s1;
create view v2 as select next value for s1;
--disable_ps2_protocol
select * from v1;
select * from v2;
select * from v2;
--enable_ps2_protocol
--error ER_NOT_SEQUENCE
select next value for v1;
drop sequence s1;
drop view v1,v2;
--echo #
--echo # MDEV 13020 Server crashes in Item_func_nextval::val_int upon
--echo # selecting NEXT or PREVIOUS VALUE for a view
--echo #
CREATE OR REPLACE VIEW v1 AS SELECT 1 AS f;
--error ER_NOT_SEQUENCE
SELECT NEXT VALUE FOR v1;
--error ER_NOT_SEQUENCE
SELECT PREVIOUS VALUE FOR v1;
drop view v1;
--echo #
--echo # MDEV 17978 Server crashes in mysqld_show_create_get_fields
--echo # upon SHOW CREATE SEQUENCE on a broken view
--echo #
CREATE TABLE t1 (a INT);
CREATE VIEW v1 AS SELECT * FROM t1;
DROP TABLE t1;
--error ER_NOT_SEQUENCE
SHOW CREATE SEQUENCE v1;
DROP VIEW v1;