[tarantool-patches] Re: [PATCH v2 2/9] box: fix _trigger and _ck_constraint access check

["n.pettik" <korablev@tarantool.org>]

> src/box/alter.cc | 17 +++++++++++++++++
> 1 file changed, 17 insertions(+)
> 
> diff --git a/src/box/alter.cc b/src/box/alter.cc
> index 0589c9678..ab3dd2e22 100644
> --- a/src/box/alter.cc
> +++ b/src/box/alter.cc
> @@ -3521,6 +3521,11 @@ on_replace_dd_trigger(struct trigger * /* trigger */, void *event)
> 		uint32_t space_id =
> 			tuple_field_u32_xc(old_tuple,
> 					   BOX_TRIGGER_FIELD_SPACE_ID);
> +		struct space *space = space_by_id(space_id);
> +		assert(space != NULL);
> +		access_check_ddl(space->def->name, space->def->id,
> +				 space->def->uid, SC_SPACE, PRIV_A);

Why did you check only alter privilege? On drop we should check
drop privilege, on alter - alter privilege and on creation - creation
privilege.

This particular branch processes drop case, so we should use PRIV_D.

> +
> 		char *trigger_name =
> 			(char *)region_alloc_xc(&fiber()->gc,
> 						trigger_name_len + 1);
> @@ -3574,6 +3579,10 @@ on_replace_dd_trigger(struct trigger * /* trigger */, void *event)
> 				  "trigger space_id does not match the value "
> 				  "resolved on AST building from SQL");
> 		}
> +		struct space *space = space_by_id(space_id);
> +		assert(space != NULL);
> +		access_check_ddl(space->def->name, space->def->id,
> +				 space->def->uid, SC_SPACE, PRIV_A);

And PRIV_C depending on situation.

The same for _fk_constraint space.

> @@ -4018,6 +4031,10 @@ on_replace_dd_fk_constraint(struct trigger * /* trigger*/, void *event)
> 			space_cache_find_xc(fk_def->child_id);
> 		struct space *parent_space =
> 			space_cache_find_xc(fk_def->parent_id);
> +		access_check_ddl(child_space->def->name, child_space->def->id,
> +				 child_space->def->uid, SC_SPACE, PRIV_A);
> +		access_check_ddl(parent_space->def->name, parent_space->def->id,
> +				 parent_space->def->uid, SC_SPACE, PRIV_A);
> 		struct fkey *old_fkey =
> 			fkey_grab_by_name(&child_space->child_fkey,
> 					  fk_def->name);

Please, add tests on these cases.