diff options
| author | Sergei Golubchik <sergii@pisem.net> | 2014-03-20 23:26:41 +0100 |
|---|---|---|
| committer | Sergei Golubchik <sergii@pisem.net> | 2014-03-20 23:26:41 +0100 |
| commit | 7b1b744f53aca6ca77f06cb1980c40da666387d1 (patch) | |
| tree | 1d42894ed10d0e66db74614304f04293ab33dcde /sql/sql_parse.cc | |
| parent | 9ff0c9f730a79d4dab4303163d45c919f612cc37 (diff) | |
| download | mariadb-git-7b1b744f53aca6ca77f06cb1980c40da666387d1.tar.gz | |
MDEV-5849 MySQL bug#12602983 - User without privilege on routine can discover its existence by executing "select non_existing_func();" or by "call non_existing_proc()"
add or move privilege checks before existence checks
Diffstat (limited to 'sql/sql_parse.cc')
| -rw-r--r-- | sql/sql_parse.cc | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc index 18e1a441f68..f2bbd7462fd 100644 --- a/sql/sql_parse.cc +++ b/sql/sql_parse.cc @@ -4642,6 +4642,10 @@ create_sp_error: open_and_lock_tables(thd, all_tables, TRUE, 0)) goto error; + if (check_routine_access(thd, EXECUTE_ACL, lex->spname->m_db.str, + lex->spname->m_name.str, TRUE, FALSE)) + goto error; + /* By this moment all needed SPs should be in cache so no need to look into DB. @@ -4691,11 +4695,6 @@ create_sp_error: thd->server_status|= SERVER_MORE_RESULTS_EXISTS; } - if (check_routine_access(thd, EXECUTE_ACL, - sp->m_db.str, sp->m_name.str, TRUE, FALSE)) - { - goto error; - } select_limit= thd->variables.select_limit; thd->variables.select_limit= HA_POS_ERROR; |