[tarantool-patches] Re: [PATCH v2 2/9] box: fix _trigger and _ck_constraint access check
n.pettik
korablev at tarantool.org
Mon Mar 11 22:29:39 MSK 2019
> src/box/alter.cc | 17 +++++++++++++++++
> 1 file changed, 17 insertions(+)
>
> diff --git a/src/box/alter.cc b/src/box/alter.cc
> index 0589c9678..ab3dd2e22 100644
> --- a/src/box/alter.cc
> +++ b/src/box/alter.cc
> @@ -3521,6 +3521,11 @@ on_replace_dd_trigger(struct trigger * /* trigger */, void *event)
> uint32_t space_id =
> tuple_field_u32_xc(old_tuple,
> BOX_TRIGGER_FIELD_SPACE_ID);
> + struct space *space = space_by_id(space_id);
> + assert(space != NULL);
> + access_check_ddl(space->def->name, space->def->id,
> + space->def->uid, SC_SPACE, PRIV_A);
Why did you check only alter privilege? On drop we should check
drop privilege, on alter - alter privilege and on creation - creation
privilege.
This particular branch processes drop case, so we should use PRIV_D.
> +
> char *trigger_name =
> (char *)region_alloc_xc(&fiber()->gc,
> trigger_name_len + 1);
> @@ -3574,6 +3579,10 @@ on_replace_dd_trigger(struct trigger * /* trigger */, void *event)
> "trigger space_id does not match the value "
> "resolved on AST building from SQL");
> }
> + struct space *space = space_by_id(space_id);
> + assert(space != NULL);
> + access_check_ddl(space->def->name, space->def->id,
> + space->def->uid, SC_SPACE, PRIV_A);
And PRIV_C depending on situation.
The same for _fk_constraint space.
> @@ -4018,6 +4031,10 @@ on_replace_dd_fk_constraint(struct trigger * /* trigger*/, void *event)
> space_cache_find_xc(fk_def->child_id);
> struct space *parent_space =
> space_cache_find_xc(fk_def->parent_id);
> + access_check_ddl(child_space->def->name, child_space->def->id,
> + child_space->def->uid, SC_SPACE, PRIV_A);
> + access_check_ddl(parent_space->def->name, parent_space->def->id,
> + parent_space->def->uid, SC_SPACE, PRIV_A);
> struct fkey *old_fkey =
> fkey_grab_by_name(&child_space->child_fkey,
> fk_def->name);
Please, add tests on these cases.
More information about the Tarantool-patches
mailing list