Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

planner: privilege check ANALYZE TABLE stmt #8486

Merged
merged 6 commits into from
Dec 28, 2018
Merged

planner: privilege check ANALYZE TABLE stmt #8486

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
6ac0e17
planner: privilege check ANALYZE TABLE stmt
morgo Nov 28, 2018
abbeded
Merge branch 'master' into analyze
morgo Nov 28, 2018
c49eb62
Merge remote-tracking branch 'upstream/master' into analyze
morgo Dec 2, 2018
d353b11
Merge branch 'master' into analyze
morgo Dec 27, 2018
62f5b9b
Addressed PR feedback
morgo Dec 27, 2018
094afa8
Merge branch 'master' into analyze
shenli Dec 27, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions planner/core/planbuilder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,7 @@ type PlanBuilder struct {
inUpdateStmt bool
// colMapper stores the column that must be pre-resolved.
colMapper map[*ast.ColumnNameExpr]int
// Collect the visit information for privilege check.
// visitInfo is used for privilege check.
visitInfo []visitInfo
tableHintInfo []tableHintInfo
optFlag uint64
Expand Down Expand Up @@ -275,7 +275,7 @@ func (b *PlanBuilder) buildSet(v *ast.SetStmt) (Plan, error) {
return p, nil
}

// Detect aggregate function or groupby clause.
// detectSelectAgg detects an aggregate function or GROUP BY clause.
func (b *PlanBuilder) detectSelectAgg(sel *ast.SelectStmt) bool {
if sel.GroupBy != nil {
return true
Expand Down Expand Up @@ -749,6 +749,10 @@ const (
)

func (b *PlanBuilder) buildAnalyze(as *ast.AnalyzeTableStmt) (Plan, error) {
for _, tbl := range as.TableNames {
b.visitInfo = appendVisitInfo(b.visitInfo, mysql.InsertPriv, tbl.Schema.O, tbl.Name.O, "")
b.visitInfo = appendVisitInfo(b.visitInfo, mysql.SelectPriv, tbl.Schema.O, tbl.Name.O, "")
}
if as.MaxNumBuckets == 0 {
as.MaxNumBuckets = defaultMaxNumBuckets
} else {
Expand Down
37 changes: 37 additions & 0 deletions privilege/privileges/privileges_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -349,6 +349,43 @@ func (s *testPrivilegeSuite) TestUseDb(c *C) {

}

func (s *testPrivilegeSuite) TestAnalyzeTable(c *C) {

se := newSession(c, s.store, s.dbName)
// high privileged user
mustExec(c, se, "CREATE USER 'asuper'")
mustExec(c, se, "CREATE USER 'anobody'")
mustExec(c, se, "GRANT ALL ON *.* TO 'asuper'")
mustExec(c, se, "FLUSH PRIVILEGES")
mustExec(c, se, "CREATE DATABASE atest")
mustExec(c, se, "use atest")
mustExec(c, se, "CREATE TABLE t1 (a int)")

c.Assert(se.Auth(&auth.UserIdentity{Username: "asuper", Hostname: "localhost", AuthUsername: "asuper", AuthHostname: "%"}, nil, nil), IsTrue)
mustExec(c, se, "analyze table mysql.user")
// low privileged user
c.Assert(se.Auth(&auth.UserIdentity{Username: "anobody", Hostname: "localhost", AuthUsername: "anobody", AuthHostname: "%"}, nil, nil), IsTrue)
_, err := se.Execute(context.Background(), "analyze table t1")
c.Assert(err, NotNil) // fails

// try again after SELECT privilege granted
c.Assert(se.Auth(&auth.UserIdentity{Username: "asuper", Hostname: "localhost", AuthUsername: "asuper", AuthHostname: "%"}, nil, nil), IsTrue)
mustExec(c, se, "GRANT SELECT ON atest.* TO 'anobody'")
mustExec(c, se, "FLUSH PRIVILEGES")
c.Assert(se.Auth(&auth.UserIdentity{Username: "anobody", Hostname: "localhost", AuthUsername: "anobody", AuthHostname: "%"}, nil, nil), IsTrue)
_, err = se.Execute(context.Background(), "analyze table t1")
c.Assert(err, NotNil) // stll fails (only select)

// Add INSERT privilege and it should work.
c.Assert(se.Auth(&auth.UserIdentity{Username: "asuper", Hostname: "localhost", AuthUsername: "asuper", AuthHostname: "%"}, nil, nil), IsTrue)
mustExec(c, se, "GRANT INSERT ON atest.* TO 'anobody'")
mustExec(c, se, "FLUSH PRIVILEGES")
c.Assert(se.Auth(&auth.UserIdentity{Username: "anobody", Hostname: "localhost", AuthUsername: "anobody", AuthHostname: "%"}, nil, nil), IsTrue)
_, err = se.Execute(context.Background(), "analyze table t1")
c.Assert(err, IsNil)

}

func (s *testPrivilegeSuite) TestInformationSchema(c *C) {

// This test tests no privilege check for INFORMATION_SCHEMA database.
Expand Down