Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ddl: add privilege check when alter table add foreign key #40051

Merged
merged 7 commits into from
Dec 20, 2022
Merged

ddl: add privilege check when alter table add foreign key #40051

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
01db8f8
ddl: add privilege check when add foreign key
crazycs520 Dec 20, 2022
96c8a9f
Merge branch 'master' into fk-test-7
ti-chi-bot Dec 20, 2022
61bb1f0
Merge branch 'master' into fk-test-7
ti-chi-bot Dec 20, 2022
709312a
Merge branch 'master' into fk-test-7
crazycs520 Dec 20, 2022
94e49f2
Merge branch 'master' into fk-test-7
ti-chi-bot Dec 20, 2022
bb8d830
Merge branch 'master' into fk-test-7
hawkingrei Dec 20, 2022
9fcc2e4
Merge branch 'master' into fk-test-7
ti-chi-bot Dec 20, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions ddl/fktest/foreign_key_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -319,6 +319,24 @@ func TestCreateTableWithForeignKeyPrivilegeCheck(t *testing.T) {
tk2.MustExec("create table t4 (a int, foreign key fk(a) references t1(id), foreign key (a) references t3(id));")
}

func TestAlterTableWithForeignKeyPrivilegeCheck(t *testing.T) {
store, _ := testkit.CreateMockStoreAndDomain(t)
tk := testkit.NewTestKit(t, store)
tk.MustExec("use test")
tk.MustExec("create user 'u1'@'%' identified by '';")
tk.MustExec("grant create,alter on *.* to 'u1'@'%';")
tk.MustExec("create table t1 (id int key);")
tk2 := testkit.NewTestKit(t, store)
tk2.MustExec("use test")
tk2.Session().Auth(&auth.UserIdentity{Username: "u1", Hostname: "localhost", CurrentUser: true, AuthUsername: "u1", AuthHostname: "%"}, nil, []byte("012345678901234567890"))
tk2.MustExec("create table t2 (a int)")
err := tk2.ExecToErr("alter table t2 add foreign key (a) references t1 (id) on update cascade")
require.Error(t, err)
require.Equal(t, "[planner:1142]REFERENCES command denied to user 'u1'@'%' for table 't1'", err.Error())
tk.MustExec("grant references on test.t1 to 'u1'@'%';")
tk2.MustExec("alter table t2 add foreign key (a) references t1 (id) on update cascade")
}

func TestRenameTableWithForeignKeyMetaInfo(t *testing.T) {
store, dom := testkit.CreateMockStoreAndDomain(t)
tk := testkit.NewTestKit(t, store)
Expand Down
8 changes: 8 additions & 0 deletions planner/core/planbuilder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4511,6 +4511,14 @@ func (b *PlanBuilder) buildDDL(ctx context.Context, node ast.DDLNode) (Plan, err
}
b.visitInfo = appendVisitInfo(b.visitInfo, mysql.UpdatePriv, mysql.SystemDB,
"stats_extended", "", authErr)
} else if spec.Tp == ast.AlterTableAddConstraint {
if b.ctx.GetSessionVars().User != nil && spec.Constraint != nil &&
spec.Constraint.Tp == ast.ConstraintForeignKey && spec.Constraint.Refer != nil {
authErr = ErrTableaccessDenied.GenWithStackByArgs("REFERENCES", b.ctx.GetSessionVars().User.AuthUsername,
b.ctx.GetSessionVars().User.AuthHostname, spec.Constraint.Refer.Table.Name.L)
b.visitInfo = appendVisitInfo(b.visitInfo, mysql.ReferencesPriv, spec.Constraint.Refer.Table.Schema.L,
spec.Constraint.Refer.Table.Name.L, "", authErr)
}
}
}
case *ast.AlterSequenceStmt:
Expand Down