• Sivert Sorumgard's avatar
    Bug#24388753: PRIVILEGE ESCALATION USING MYSQLD_SAFE · 48bd8b16
    Sivert Sorumgard authored
    [This is the 5.5/5.6 version of the bugfix].
    
    The problem was that it was possible to write log files ending
    in .ini/.cnf that later could be parsed as an options file.
    This made it possible for users to specify startup options
    without the permissions to do so.
    
    This patch fixes the problem by disallowing general query log
    and slow query log to be written to files ending in .ini and .cnf.
    48bd8b16
log.h 26.3 KB