Commit e84229b0 authored by unknown's avatar unknown
Browse files

stop evaluation constant functions in WHERE (BUG#4663) 

correct value of CURRENT_USER() in SP with "security definer" (BUG#7291)


BitKeeper/etc/config:
  switch off open logging
mysql-test/r/sp-security.result:
  correct value from current_user() in function run from "security definer"
mysql-test/r/view.result:
  evaluation constant functions in WHERE (BUG#4663)
mysql-test/t/sp-security.test:
  correct value from current_user() in function run from "security definer"
mysql-test/t/view.test:
  evaluation constant functions in WHERE (BUG#4663)
sql/item.cc:
  Item_static_string_func creation if it is need
sql/item.h:
  support of Item_static_string_func creation
sql/item_cmpfunc.cc:
  do not evaluate items during view creation
sql/item_create.cc:
  create Item_func_user
sql/item_strfunc.cc:
  Item_func_sysconst in case of converting value still have to correctly print itself
  => use Item_static_string_func instead of Item_string
      Item_func_user return USER() or CURRENT_USER()
sql/item_strfunc.h:
  support of correct charset conversion procedure in Item_func_sysconst
sql/sql_class.h:
  new method
sql/sql_yacc.yy:
  Item_func_user now support both USER() and CURRENT_USER(), so we have to pass parametr what it is
parent 5ae3967c

BitKeeper/etc/config

+1 −1
Original line number Diff line number Diff line
@@ -24,7 +24,7 @@ description: MySQL - fast and reliable SQL database 
# repository is commercial it can be an internal email address or "none"

# to disable logging.

# 

logging:  logging@openlogging.org

logging:  none

# 

# If this field is set, all checkins will appear to be made by this user,

# in effect making this a single user package.  Single user packages are

mysql-test/r/sp-security.result

+24 −0
Original line number Diff line number Diff line
@@ -194,3 +194,27 @@ use test; 
drop database sptest;

delete from mysql.user where user='usera' or user='userb' or user='userc';

delete from mysql.procs_priv where user='usera' or user='userb' or user='userc';

use test;

select current_user();

current_user()

root@localhost

select user();

user()

root@localhost

create procedure bug7291_0 () sql security invoker select current_user(), user();

create procedure bug7291_1 () sql security definer call bug7291_0();

create procedure bug7291_2 () sql security invoker call bug7291_0();

grant execute on procedure bug7291_0 to user1@localhost;

grant execute on procedure bug7291_1 to user1@localhost;

grant execute on procedure bug7291_2 to user1@localhost;

call bug7291_2();

current_user()	user()

user1@localhost	user1@localhost

call bug7291_1();

current_user()	user()

root@localhost	user1@localhost

drop procedure bug7291_1;

drop procedure bug7291_2;

drop procedure bug7291_0;

REVOKE ALL PRIVILEGES, GRANT OPTION FROM user1@localhost;

drop user user1@localhost;

mysql-test/r/view.result

+25 −0
Original line number Diff line number Diff line
@@ -1831,3 +1831,28 @@ select * from v1; 
t

01:00

drop view v1;

create table t1 (a timestamp default now());

create table t2 (b timestamp default now());

create view v1 as select a,b,t1.a < now() from t1,t2 where t1.a < now();

SHOW CREATE VIEW v1;

View	Create View

v1	CREATE ALGORITHM=UNDEFINED VIEW `test`.`v1` AS select sql_no_cache `test`.`t1`.`a` AS `a`,`test`.`t2`.`b` AS `b`,(`test`.`t1`.`a` < now()) AS `t1.a < now()` from `test`.`t1` join `test`.`t2` where (`test`.`t1`.`a` < now())

drop view v1;

drop table t1, t2;

CREATE TABLE t1 ( a varchar(50) );

CREATE VIEW v1 AS SELECT * FROM t1 WHERE a = CURRENT_USER();

SHOW CREATE VIEW v1;

View	Create View

v1	CREATE ALGORITHM=UNDEFINED VIEW `test`.`v1` AS select sql_no_cache `test`.`t1`.`a` AS `a` from `test`.`t1` where (`test`.`t1`.`a` = current_user())

DROP VIEW v1;

CREATE VIEW v1 AS SELECT * FROM t1 WHERE a = VERSION();

SHOW CREATE VIEW v1;

View	Create View

v1	CREATE ALGORITHM=UNDEFINED VIEW `test`.`v1` AS select `test`.`t1`.`a` AS `a` from `test`.`t1` where (`test`.`t1`.`a` = version())

DROP VIEW v1;

CREATE VIEW v1 AS SELECT * FROM t1 WHERE a = DATABASE();

SHOW CREATE VIEW v1;

View	Create View

v1	CREATE ALGORITHM=UNDEFINED VIEW `test`.`v1` AS select sql_no_cache `test`.`t1`.`a` AS `a` from `test`.`t1` where (`test`.`t1`.`a` = database())

DROP VIEW v1;

DROP TABLE t1;

mysql-test/t/sp-security.test

+29 −0
Original line number Diff line number Diff line
@@ -304,3 +304,32 @@ drop database sptest; 
delete from mysql.user where user='usera' or user='userb' or user='userc';

delete from mysql.procs_priv where user='usera' or user='userb' or user='userc';



#

# correct value from current_user() in function run from "security definer"

# (BUG#7291)

#

connection con1root;

use test;



select current_user();

select user();

create procedure bug7291_0 () sql security invoker select current_user(), user();

create procedure bug7291_1 () sql security definer call bug7291_0();

create procedure bug7291_2 () sql security invoker call bug7291_0();

grant execute on procedure bug7291_0 to user1@localhost;

grant execute on procedure bug7291_1 to user1@localhost;

grant execute on procedure bug7291_2 to user1@localhost;



connect (user1,localhost,user1,,);

connection user1;



call bug7291_2();

call bug7291_1();



connection con1root;

drop procedure bug7291_1;

drop procedure bug7291_2;

drop procedure bug7291_0;

disconnect user1;

REVOKE ALL PRIVILEGES, GRANT OPTION FROM user1@localhost;

drop user user1@localhost;

mysql-test/t/view.test

+21 −0
Original line number Diff line number Diff line
@@ -1673,3 +1673,24 @@ create view v1(k, K) as select 1,2; 
create view v1 as SELECT TIME_FORMAT(SEC_TO_TIME(3600),'%H:%i') as t;

select * from v1;

drop view v1;



#

# evaluation constant functions in WHERE (BUG#4663)

#

create table t1 (a timestamp default now());

create table t2 (b timestamp default now());

create view v1 as select a,b,t1.a < now() from t1,t2 where t1.a < now();

SHOW CREATE VIEW v1;

drop view v1;

drop table t1, t2;

CREATE TABLE t1 ( a varchar(50) );

CREATE VIEW v1 AS SELECT * FROM t1 WHERE a = CURRENT_USER();

SHOW CREATE VIEW v1;

DROP VIEW v1;

CREATE VIEW v1 AS SELECT * FROM t1 WHERE a = VERSION();

SHOW CREATE VIEW v1;

DROP VIEW v1;

CREATE VIEW v1 AS SELECT * FROM t1 WHERE a = DATABASE();

SHOW CREATE VIEW v1;

DROP VIEW v1;

DROP TABLE t1;