Security fix: LOCK TABLES must check for sufficient privileges.

a37b9715 · tim@threads.polyesthetic.msg · 579d9c1e · a37b9715
Commit a37b9715 authored May 22, 2001 by tim@threads.polyesthetic.msg
Show whitespace changes
Inline Side-by-side

Showing with 9 additions and 0 deletions

sql/sql_parse.cc sql/sql_parse.cc +9 -0

No files found.
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -1851,6 +1851,15 @@ mysql_execute_command(void)
    }
    if (check_db_used(thd,tables) || end_active_trans(thd))
      goto error;
+    for (TABLE_LIST *tmp = tables; tmp; tmp = tmp->next)
+    {
+      if (!(tmp->lock_type == TL_READ_NO_INSERT ?
+            !check_table_access(thd, SELECT_ACL, tmp) :
+            (!check_table_access(thd, INSERT_ACL, tmp) ||
+             !check_table_access(thd, UPDATE_ACL, tmp) ||
+             !check_table_access(thd, DELETE_ACL, tmp))))
+         goto error;
+    }
    thd->in_lock_tables=1;
    if (!(res=open_and_lock_tables(thd,tables)))
    {