Commit 870157e9 authored by unknown's avatar unknown
Browse files

Bug #17139: Partitions: unprivileged user can effectively drop table 

Now the DROP privilege is also required on a table in order to be able
to drop a partition from the table using ALTER TABLE.


sql/sql_parse.cc:
  Require DROP privilege in addition to ALTER for dropping a partition
mysql-test/r/partition_grant.result:
  New BitKeeper file ``mysql-test/r/partition_grant.result''
mysql-test/t/partition_grant.test:
  New BitKeeper file ``mysql-test/t/partition_grant.test''
parent 29c66eea

mysql-test/r/partition_grant.result

0 → 100644
+23 −0
Original line number Diff line number Diff line 
drop schema if exists mysqltest_1;

create schema mysqltest_1;

use mysqltest_1;

create table t1 (a int) partition by list (a) (partition p1 values in (1), partition p2 values in (2), partition p3 values in (3));

insert into t1 values (1),(2);

grant select,alter on mysqltest_1.* to mysqltest_1@localhost;

show grants for current_user;

Grants for mysqltest_1@localhost

GRANT USAGE ON *.* TO 'mysqltest_1'@'localhost'

GRANT SELECT, ALTER ON `mysqltest_1`.* TO 'mysqltest_1'@'localhost'

alter table t1 add b int;

alter table t1 drop partition p2;

ERROR 42000: DROP command denied to user 'mysqltest_1'@'localhost' for table 't1'

grant drop on mysqltest_1.* to mysqltest_1@localhost;

alter table t1 drop partition p2;

revoke alter on mysqltest_1.* from mysqltest_1@localhost;

alter table t1 drop partition p3;

ERROR 42000: ALTER command denied to user 'mysqltest_1'@'localhost' for table 't1'

revoke select,alter,drop on mysqltest_1.* from mysqltest_1@localhost;

drop user mysqltest_1@localhost;

drop table t1;

drop schema mysqltest_1;

End of 5.1 tests

mysql-test/t/partition_grant.test

0 → 100644
+51 −0
Original line number Diff line number Diff line 
-- source include/have_partition.inc

# Grant tests not performed with embedded server

-- source include/not_embedded.inc



--disable_warnings

drop schema if exists mysqltest_1;

--enable_warnings





#

# Bug #17139: ALTER TABLE ... DROP PARTITION should require DROP privilege

#



create schema mysqltest_1;

use mysqltest_1;



create table t1 (a int) partition by list (a) (partition p1 values in (1), partition p2 values in (2), partition p3 values in (3));

insert into t1 values (1),(2);



grant select,alter on mysqltest_1.* to mysqltest_1@localhost;



connect (conn1,localhost,mysqltest_1,,mysqltest_1);

show grants for current_user;

alter table t1 add b int;

--error ER_TABLEACCESS_DENIED_ERROR

alter table t1 drop partition p2;

disconnect conn1;



connection default;

grant drop on mysqltest_1.* to mysqltest_1@localhost;



connect (conn2,localhost,mysqltest_1,,mysqltest_1);

alter table t1 drop partition p2;

disconnect conn2;



connection default;

revoke alter on mysqltest_1.* from mysqltest_1@localhost;



connect (conn3,localhost,mysqltest_1,,mysqltest_1);

--error ER_TABLEACCESS_DENIED_ERROR

alter table t1 drop partition p3;

disconnect conn3;



connection default;



revoke select,alter,drop on mysqltest_1.* from mysqltest_1@localhost;

drop user mysqltest_1@localhost;

drop table t1;

drop schema mysqltest_1;



--echo End of 5.1 tests

sql/sql_parse.cc

+7 −2
Original line number Diff line number Diff line
@@ -2975,6 +2975,11 @@ mysql_execute_command(THD *thd) 
#else

    {

      ulong priv=0;

      ulong priv_needed= ALTER_ACL;

      /* We also require DROP priv for ALTER TABLE ... DROP PARTITION */

      if (lex->alter_info.flags & ALTER_DROP_PARTITION)

        priv_needed|= DROP_ACL;



      if (lex->name && (!lex->name[0] || strlen(lex->name) > NAME_LEN))

      {

	my_error(ER_WRONG_TABLE_NAME, MYF(0), lex->name);
@@ -2999,7 +3004,7 @@ mysql_execute_command(THD *thd) 
        else

          select_lex->db= first_table->db;

      }

      if (check_access(thd, ALTER_ACL, first_table->db,

      if (check_access(thd, priv_needed, first_table->db,

		       &first_table->grant.privilege, 0, 0,

                       test(first_table->schema_table)) ||

	  check_access(thd,INSERT_ACL | CREATE_ACL,select_lex->db,&priv,0,0,
@@ -3010,7 +3015,7 @@ mysql_execute_command(THD *thd) 
	goto error;				/* purecov: inspected */

      if (grant_option)

      {

	if (check_grant(thd, ALTER_ACL, all_tables, 0, UINT_MAX, 0))

	if (check_grant(thd, priv_needed, all_tables, 0, UINT_MAX, 0))

	  goto error;

	if (lex->name && !test_all_bits(priv,INSERT_ACL | CREATE_ACL))

	{					// Rename of table