diff options
| author | Dmitry Shulga <dmitry.shulga@mariadb.com> | 2021-04-13 09:38:32 +0700 |
|---|---|---|
| committer | Dmitry Shulga <dmitry.shulga@mariadb.com> | 2021-04-13 09:38:32 +0700 |
| commit | 61f84bba603aa85957b48d151f9ddf5ba4e71ab1 (patch) | |
| tree | 2be7a6d393c6dff0b96c91d0433180ffd57674ce /sql/sql_parse.cc | |
| parent | e14b682636bc78a20cb7bedf2af696a3f1eb79bc (diff) | |
| download | mariadb-git-bb-10.4-MDEV-25197-3.tar.gz | |
MDEV-25197: The statement set password=password('') executed in PS mode fails in case it is run by a user with expired passwordbb-10.4-MDEV-25197-3
A user connected to a server with an expired password
can't change password with the statement "SET password=..."
if this statement is run in PS mode. In mentioned use case a user
gets the error ER_MUST_CHANGE_PASSWORD on attempt to run
the statement PREPARE stmt FOR "SET password=...";
The reason of failure to reset password by a locked user using the
statement PREPARE stmt FOR "SET password=..." is that PS-related
statements are not listed among the commands allowed for execution
by a user with expired password. However, simple adding of PS-related
statements (PREPARE FOR/EXECUTE/DEALLOCATE PREPARE ) to the list of
statements allowed for execution by a locked user is not enough
to solve problems, since it opens the opportunity for a locked user
to execute any statement in the PS mode.
To exclude this opportunity, additional checking that the statement
being prepared for execution in PS-mode is the SET statement has to be added.
This extra checking has been added by this patch into the method
Prepared_statement::prepared() that executed on preparing any statement
for execution in PS-mode.
Diffstat (limited to 'sql/sql_parse.cc')
| -rw-r--r-- | sql/sql_parse.cc | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc index cd188ab693e..3ae7c7c7df3 100644 --- a/sql/sql_parse.cc +++ b/sql/sql_parse.cc @@ -1641,7 +1641,9 @@ bool dispatch_command(enum enum_server_command command, THD *thd, if (unlikely(thd->security_ctx->password_expired && command != COM_QUERY && command != COM_PING && - command != COM_QUIT)) + command != COM_QUIT && + command != COM_STMT_PREPARE && + command != COM_STMT_EXECUTE)) { my_error(ER_MUST_CHANGE_PASSWORD, MYF(0)); goto dispatch_end; @@ -3490,7 +3492,10 @@ mysql_execute_command(THD *thd) first_table->for_insert_data); if (thd->security_ctx->password_expired && - lex->sql_command != SQLCOM_SET_OPTION) + lex->sql_command != SQLCOM_SET_OPTION && + lex->sql_command != SQLCOM_PREPARE && + lex->sql_command != SQLCOM_EXECUTE && + lex->sql_command != SQLCOM_DEALLOCATE_PREPARE) { my_error(ER_MUST_CHANGE_PASSWORD, MYF(0)); DBUG_RETURN(1); |