From 2af9e8af6efba951e33e148d0b1a34beb25be831 Mon Sep 17 00:00:00 2001 From: Karthik Kamath Date: Thu, 11 Jan 2018 19:48:12 +0530 Subject: BUG#27160888: MISSING FILE PRIVILEDGE CHECKS ON SOME STATEMENTS ANALYSIS: ========= A user not having FILE privilege is not allowed to create custom data/index directories for a table or for its partitions via CREATE TABLE but is allowed to do so via ALTER TABLE statement. ALTER TABLE ignores DATA DIRECTORY and INDEX DIRECTORY when given as table options. The issue occurs during the creation of partitions for a table via ALTER TABLE statement with the DATA DIRECTORY and/or INDEX DIRECTORY options. The issue exists because of the absence of FILE privilege check for the user. FIX: ==== A FILE privilege check has been introduced for resolving the above scenario. --- sql/sql_alter.cc | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/sql/sql_alter.cc b/sql/sql_alter.cc index 6247d581830..660efe2d177 100644 --- a/sql/sql_alter.cc +++ b/sql/sql_alter.cc @@ -1,4 +1,4 @@ -/* Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved. +/* Copyright (c) 2010, 2018, Oracle and/or its affiliates. All rights reserved. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -18,6 +18,8 @@ // mysql_exchange_partition #include "sql_alter.h" +bool has_external_data_or_index_dir(partition_info &pi); + bool Alter_table_statement::execute(THD *thd) { LEX *lex= thd->lex; @@ -42,6 +44,16 @@ bool Alter_table_statement::execute(THD *thd) if (thd->is_fatal_error) /* out of memory creating a copy of alter_info */ DBUG_RETURN(TRUE); + +#ifdef WITH_PARTITION_STORAGE_ENGINE + { + partition_info *part_info= thd->lex->part_info; + if (part_info != NULL && has_external_data_or_index_dir(*part_info) && + check_access(thd, FILE_ACL, any_db, NULL, NULL, FALSE, FALSE)) + + DBUG_RETURN(TRUE); + } +#endif /* We also require DROP priv for ALTER TABLE ... DROP PARTITION, as well as for RENAME TO, as being done by SQLCOM_RENAME_TABLE -- cgit v1.2.1