Skip to content

M
MariaDB
Commit 64b27c73 authored by Vicentiu Ciorbaru's avatar Vicentiu Ciorbaru Committed by Sergei Golubchik
Browse files
Options

Added default role implementation

parent 43351faf
Expand all Show whitespace changes
Inline Side-by-side
Showing with 751 additions and 42 deletions
mysql-test/r/ps.result
View file @ 64b27c73
......@@ -1202,13 +1202,13 @@ SET @aux= "SELECT COUNT(*)
prepare my_stmt from @aux;
execute my_stmt;
COUNT(*)
44
45
execute my_stmt;
COUNT(*)
44
45
execute my_stmt;
COUNT(*)
44
45
deallocate prepare my_stmt;
drop procedure if exists p1|
drop table if exists t1|
......
mysql-test/suite/roles/create_and_drop_role_invalid_user_table.result
View file @ 64b27c73
use mysql;
alter table user drop column is_role;
alter table user drop column default_role;
flush privileges;
create role test_role;
ERROR HY000: Column count of mysql.user is wrong. Expected 44, found 43. Created with MariaDB MYSQL_VERSION_ID, now running MYSQL_VERSION_ID. Please use mysql_upgrade to fix this error.
......@@ -8,6 +9,9 @@ ERROR HY000: Operation DROP ROLE failed for 'test_role'
alter table user add column is_role enum('N', 'Y') default 'N' not null
COLLATE utf8_general_ci
after password_expired;
alter table user add column default_role char(80) binary default '' not null
COLLATE utf8_general_ci
after is_role;
update user set is_role='N';
flush privileges;
create role test_role;
......
mysql-test/suite/roles/create_and_drop_role_invalid_user_table.test
View file @ 64b27c73
......@@ -4,6 +4,7 @@ connect (mysql, localhost, root,,);
use mysql;
alter table user drop column is_role;
alter table user drop column default_role;
flush privileges;
......@@ -15,12 +16,12 @@ drop role test_role;
alter table user add column is_role enum('N', 'Y') default 'N' not null
COLLATE utf8_general_ci
after password_expired;
alter table user add column default_role char(80) binary default '' not null
COLLATE utf8_general_ci
after is_role;
update user set is_role='N';
flush privileges;
create role test_role;
drop role test_role;
mysql-test/suite/roles/set_default_role_clear.result 0 → 100644
View file @ 64b27c73
create user test_user@localhost;
create role test_role;
grant select on *.* to test_role;
grant test_role to test_user@localhost;
show grants;
Grants for test_user@localhost
GRANT test_role TO 'test_user'@'localhost'
GRANT USAGE ON *.* TO 'test_user'@'localhost'
set default role test_role;
select user, host, default_role from mysql.user;
ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user'
select user, host, default_role from mysql.user where user='test_user';
user host default_role
test_user localhost test_role
show grants;
Grants for test_user@localhost
GRANT test_role TO 'test_user'@'localhost'
GRANT USAGE ON *.* TO 'test_user'@'localhost'
GRANT SELECT ON *.* TO 'test_role'
select user, host, default_role from mysql.user where user='test_user';
user host default_role
test_user localhost test_role
set default role NONE;
select user, host, default_role from mysql.user where user='test_user';
user host default_role
test_user localhost
set default role invalid_role;
ERROR OP000: Invalid role specification `invalid_role`.
select user, host, default_role from mysql.user where user='test_user';
user host default_role
test_user localhost
select user, host, default_role from mysql.user;
ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user'
drop role test_role;
drop user test_user@localhost;
mysql-test/suite/roles/set_default_role_clear.test 0 → 100644
View file @ 64b27c73
source include/not_embedded.inc;
# This test checks clearing a default role from a user.
# Create a user with no privileges
create user test_user@localhost;
create role test_role;
grant select on *.* to test_role;
grant test_role to test_user@localhost;
change_user 'test_user';
show grants;
set default role test_role;
# Even though a user has the default role set, without reconnecting, we should
# not already have the roles privileges.
--error ER_TABLEACCESS_DENIED_ERROR
select user, host, default_role from mysql.user;
change_user 'root';
select user, host, default_role from mysql.user where user='test_user';
change_user 'test_user';
# This should show that the new test_user has the role's grants enabled.
show grants;
select user, host, default_role from mysql.user where user='test_user';
set default role NONE;
# We should still have the role set right now.
select user, host, default_role from mysql.user where user='test_user';
# Make sure we do not somehow get privileges to set an invalid role
--error ER_INVALID_ROLE
set default role invalid_role;
change_user 'root';
select user, host, default_role from mysql.user where user='test_user';
change_user 'test_user';
# The user does not have a default role set anymore. Make sure we don't still
# get the privileges.
--error ER_TABLEACCESS_DENIED_ERROR
select user, host, default_role from mysql.user;
change_user 'root';
# Cleanup
drop role test_role;
drop user test_user@localhost;
mysql-test/suite/roles/set_default_role_for.result 0 → 100644
View file @ 64b27c73
create user user_a@localhost;
create user user_b@localhost;
create role role_a;
create role role_b;
grant role_a to user_a@localhost;
grant role_b to user_b@localhost;
grant role_a to user_a@localhost;
grant select on *.* to role_a;
grant role_b to user_b@localhost;
grant insert, update on *.* to role_b;
set default role role_a for user_b@localhost;
ERROR 42000: Access denied for user 'user_a'@'localhost' to database 'mysql'
set default role role_a for user_a@localhost;
set default role invalid_role for user_a@localhost;
ERROR OP000: Invalid role specification `invalid_role`.
set default role role_b for user_a@localhost;
ERROR OP000: Invalid role specification `role_b`.
set default role role_b for user_b@localhost;
show grants;
Grants for user_a@localhost
GRANT role_a TO 'user_a'@'localhost'
GRANT USAGE ON *.* TO 'user_a'@'localhost'
GRANT SELECT ON *.* TO 'role_a'
select user, host, default_role from mysql.user where user like 'user_%';
user host default_role
user_a localhost role_a
user_b localhost role_b
set default role NONE for current_user;
select user, host, default_role from mysql.user where user like 'user_%';
user host default_role
user_a localhost
user_b localhost role_b
set default role current_role for current_user;
select user, host, default_role from mysql.user where user like 'user_%';
user host default_role
user_a localhost role_a
user_b localhost role_b
set default role role_b for current_user;
ERROR OP000: Invalid role specification `role_b`.
show grants;
Grants for user_b@localhost
GRANT role_b TO 'user_b'@'localhost'
GRANT USAGE ON *.* TO 'user_b'@'localhost'
GRANT INSERT, UPDATE ON *.* TO 'role_b'
select user, host, default_role from mysql.user where user like 'user_%';
ERROR 42000: SELECT command denied to user 'user_b'@'localhost' for table 'user'
insert into mysql.user (user, host) values ('someuser', 'somehost');
Warnings:
Warning 1364 Field 'ssl_cipher' doesn't have a default value
Warning 1364 Field 'x509_issuer' doesn't have a default value
Warning 1364 Field 'x509_subject' doesn't have a default value
Warning 1364 Field 'authentication_string' doesn't have a default value
set default role NONE for user_a@localhost;
show grants;
Grants for user_a@localhost
GRANT role_a TO 'user_a'@'localhost'
GRANT USAGE ON *.* TO 'user_a'@'localhost'
GRANT INSERT, UPDATE ON *.* TO 'role_b'
select user, host, default_role from mysql.user where user like 'user_%';
ERROR 42000: SELECT command denied to user 'user_a'@'localhost' for table 'user'
drop role role_a;
drop role role_b;
drop user someuser@somehost;
drop user user_a@localhost;
drop user user_b@localhost;
mysql-test/suite/roles/set_default_role_for.test 0 → 100644
View file @ 64b27c73
source include/not_embedded.inc;
# This test checks setting a default role to a different user;
create user user_a@localhost;
create user user_b@localhost;
create role role_a;
create role role_b;
grant role_a to user_a@localhost;
grant role_b to user_b@localhost;
grant role_a to user_a@localhost;
grant select on *.* to role_a;
grant role_b to user_b@localhost;
grant insert, update on *.* to role_b;
change_user 'user_a';
# A user should not be a able to set a default role for someone else,
# if he hasn't got write access to the database.
--error ER_DBACCESS_DENIED_ERROR
set default role role_a for user_b@localhost;
# Should have the same effect as set default role role_a.
set default role role_a for user_a@localhost;
change_user 'root';
# Not even a 'root' user should be able to set an invalid role for a user.
--error ER_INVALID_ROLE
set default role invalid_role for user_a@localhost;
--error ER_INVALID_ROLE
set default role role_b for user_a@localhost;
# Make sure we can set a default role for a different user than the one that
# is actually running the command.
set default role role_b for user_b@localhost;
change_user 'user_a';
show grants;
select user, host, default_role from mysql.user where user like 'user_%';
set default role NONE for current_user;
select user, host, default_role from mysql.user where user like 'user_%';
set default role current_role for current_user;
select user, host, default_role from mysql.user where user like 'user_%';
# Make sure we can't set a default role not granted to us, using current_user
--error ER_INVALID_ROLE
set default role role_b for current_user;
change_user 'user_b';
show grants;
--error ER_TABLEACCESS_DENIED_ERROR
select user, host, default_role from mysql.user where user like 'user_%';
# Make sure the default role setting worked from root.
insert into mysql.user (user, host) values ('someuser', 'somehost');
# Since we have update privileges on the mysql.user table, we should
# be able to set a default role for a different user.
set default role NONE for user_a@localhost;
change_user 'user_a';
# There is no default role set any more.
show grants;
--error ER_TABLEACCESS_DENIED_ERROR
select user, host, default_role from mysql.user where user like 'user_%';
change_user 'root';
drop role role_a;
drop role role_b;
drop user someuser@somehost;
drop user user_a@localhost;
drop user user_b@localhost;
mysql-test/suite/roles/set_default_role_invalid.result 0 → 100644
View file @ 64b27c73
create user test_user@localhost;
create role test_role;
create role not_granted_role;
grant select on *.* to test_role;
grant test_role to test_user@localhost;
show grants;
Grants for test_user@localhost
GRANT test_role TO 'test_user'@'localhost'
GRANT USAGE ON *.* TO 'test_user'@'localhost'
select user, host, default_role from mysql.user;
ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user'
set default role invalid_role;
ERROR OP000: Invalid role specification `invalid_role`.
set default role not_granted_role;
ERROR OP000: Invalid role specification `not_granted_role`.
set default role test_role;
select user, host, default_role from mysql.user;
ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user'
select user, host, default_role from mysql.user where user='test_user';
user host default_role
test_user localhost test_role
show grants;
Grants for test_user@localhost
GRANT test_role TO 'test_user'@'localhost'
GRANT USAGE ON *.* TO 'test_user'@'localhost'
GRANT SELECT ON *.* TO 'test_role'
select user, host, default_role from mysql.user where user='test_user';
user host default_role
test_user localhost test_role
set default role invalid_role;
ERROR OP000: Invalid role specification `invalid_role`.
select user, host, default_role from mysql.user where user='test_user';
user host default_role
test_user localhost test_role
revoke test_role from test_user@localhost;
select user, host, default_role from mysql.user where user='test_user';
ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user'
drop role test_role;
drop role not_granted_role;
drop user test_user@localhost;
mysql-test/suite/roles/set_default_role_invalid.test 0 → 100644
View file @ 64b27c73
source include/not_embedded.inc;
# This test checks the error paths possible during set default role.
# Create a user with no privileges
create user test_user@localhost;
create role test_role;
create role not_granted_role;
grant select on *.* to test_role;
grant test_role to test_user@localhost;
change_user 'test_user';
show grants;
--error ER_TABLEACCESS_DENIED_ERROR
select user, host, default_role from mysql.user;
# A user can not set a default role that does not exist in the database.
--error ER_INVALID_ROLE
set default role invalid_role;
# A user can not set a default role if he can not call set role <role>.
--error ER_INVALID_ROLE
set default role not_granted_role;
set default role test_role;
# Even though a user has the default role set, without reconnecting, we should
# not already have the roles privileges.
--error ER_TABLEACCESS_DENIED_ERROR
select user, host, default_role from mysql.user;
change_user 'root';
select user, host, default_role from mysql.user where user='test_user';
change_user 'test_user';
# This should show that the new test_user has the role's grants enabled.
show grants;
select user, host, default_role from mysql.user where user='test_user';
# If we have a failed set default role attempt, don't change the already set
# default role.
--error ER_INVALID_ROLE
set default role invalid_role;
select user, host, default_role from mysql.user where user='test_user';
change_user 'root';
# Now, even though a default role is still set for test_user, make sure the
# user does not get the rights, if he can not set the role.
revoke test_role from test_user@localhost;
change_user 'test_user';
--error ER_TABLEACCESS_DENIED_ERROR
select user, host, default_role from mysql.user where user='test_user';
change_user 'root';
# Cleanup
drop role test_role;
drop role not_granted_role;
drop user test_user@localhost;
mysql-test/suite/roles/set_default_role_new_connection.result 0 → 100644
View file @ 64b27c73
create user test_user@localhost;
create role test_role;
grant select on *.* to test_role;
grant test_role to test_user@localhost;
show grants;
Grants for test_user@localhost
GRANT test_role TO 'test_user'@'localhost'
GRANT USAGE ON *.* TO 'test_user'@'localhost'
select user, host, default_role from mysql.user where user = 'test_user';
ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user'
set default role test_role;
select user, host, default_role from mysql.user where user = 'test_user';
ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user'
select user, host, default_role from mysql.user where user = 'test_user';
user host default_role
test_user localhost test_role
show grants;
Grants for test_user@localhost
GRANT test_role TO 'test_user'@'localhost'
GRANT USAGE ON *.* TO 'test_user'@'localhost'
GRANT SELECT ON *.* TO 'test_role'
select user, host, default_role from mysql.user where user = 'test_user';
user host default_role
test_user localhost test_role
set default role NONE;
select user, host, default_role from mysql.user where user = 'test_user';
user host default_role
test_user localhost
show grants;
Grants for test_user@localhost
GRANT test_role TO 'test_user'@'localhost'
GRANT USAGE ON *.* TO 'test_user'@'localhost'
select user, host, default_role from mysql.user where user = 'test_user';
ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'user'
select user, host, default_role from mysql.user where user = 'test_user';
user host default_role
test_user localhost
set default role test_role for test_user@localhost;
show grants;
Grants for test_user@localhost
GRANT test_role TO 'test_user'@'localhost'
GRANT USAGE ON *.* TO 'test_user'@'localhost'
GRANT SELECT ON *.* TO 'test_role'
select user, host, default_role from mysql.user where user = 'test_user';
user host default_role
test_user localhost test_role
drop role test_role;
drop user test_user@localhost;
mysql-test/suite/roles/set_default_role_new_connection.test 0 → 100644
View file @ 64b27c73
source include/not_embedded.inc;
create user test_user@localhost;
create role test_role;
grant select on *.* to test_role;
grant test_role to test_user@localhost;
--connect (c1, localhost, test_user,,)
show grants;
--error ER_TABLEACCESS_DENIED_ERROR
select user, host, default_role from mysql.user where user = 'test_user';
set default role test_role;
--error ER_TABLEACCESS_DENIED_ERROR
select user, host, default_role from mysql.user where user = 'test_user';
disconnect c1;
connection default;
select user, host, default_role from mysql.user where user = 'test_user';
--connect (c1, localhost, test_user,,)
show grants;
select user, host, default_role from mysql.user where user = 'test_user';
set default role NONE;
disconnect c1;
connection default;
select user, host, default_role from mysql.user where user = 'test_user';
--connect (c1, localhost, test_user,,)
show grants;
--error ER_TABLEACCESS_DENIED_ERROR
select user, host, default_role from mysql.user where user = 'test_user';
disconnect c1;
connection default;
select user, host, default_role from mysql.user where user = 'test_user';
set default role test_role for test_user@localhost;
--connect (c1, localhost, test_user,,)
show grants;
select user, host, default_role from mysql.user where user = 'test_user';
disconnect c1;
connection default;
drop role test_role;
drop user test_user@localhost;
mysql-test/suite/roles/set_role-recursive.result
View file @ 64b27c73
......@@ -16,10 +16,10 @@ Host User Role Admin_option
test_role1 test_role2 N
grant select on *.* to test_role2;
select * from mysql.user where user like 'test_role1';
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role
test_role1 N N N N N N N N N N N N N N N N N N N N N N N N N N N N N 0 0 0 0 N Y
select * from mysql.user where user like 'test_role2';
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role
test_role2 Y N N N N N N N N N N N N N N N N N N N N N N N N N N N N 0 0 0 0 N Y
select * from mysql.roles_mapping;
ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'roles_mapping'
......
mysql-test/suite/roles/set_role-simple.result
View file @ 64b27c73
......@@ -11,7 +11,7 @@ localhost root test_role1 Y
localhost test_user test_role1 N
grant select on *.* to test_role1;
select * from mysql.user where user='test_role1';
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role
Host User Password Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired is_role default_role
test_role1 Y N N N N N N N N N N N N N N N N N N N N N N N N N N N N 0 0 0 0 N Y
select * from mysql.roles_mapping;
ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'roles_mapping'
......
sql/set_var.cc
View file @ 64b27c73
......@@ -852,6 +852,7 @@ int set_var_password::update(THD *thd)
/*****************************************************************************
Functions to handle SET ROLE
*****************************************************************************/
int set_var_role::check(THD *thd)
{
#ifndef NO_EMBEDDED_ACCESS_CHECKS
......@@ -871,6 +872,29 @@ int set_var_role::update(THD *thd)
#endif
}
/*****************************************************************************
Functions to handle SET DEFAULT ROLE
*****************************************************************************/
int set_var_default_role::check(THD *thd)
{
#ifndef NO_EMBEDDED_ACCESS_CHECKS
user= get_current_user(thd, user);
int status= acl_check_set_default_role(thd, user->host.str, user->user.str);
return status;
#else
return 0;
#endif
}
int set_var_default_role::update(THD *thd)
{
#ifndef NO_EMBEDDED_ACCESS_CHECKS
return acl_set_default_role(thd, user->host.str, user->user.str, role.str);
#else
return 0;
#endif
}
/*****************************************************************************
Functions to handle SET NAMES and SET CHARACTER SET
......
sql/set_var.h
View file @ 64b27c73
......@@ -291,6 +291,18 @@ class set_var_role: public set_var_base
int update(THD *thd);
};
/* For SET DEFAULT ROLE */
class set_var_default_role: public set_var_base
{
LEX_USER *user;
LEX_STRING role;
public:
set_var_default_role(LEX_USER *user_arg, LEX_STRING role_arg) :
user(user_arg), role(role_arg) {}
int check(THD *thd);
int update(THD *thd);
};
/* For SET NAMES and SET CHARACTER SET */
......
sql/share/errmsg-utf8.txt
View file @ 64b27c73
......@@ -2936,7 +2936,7 @@ ER_PASSWORD_ANONYMOUS_USER 42000
cze "Používáte MySQL jako anonymní uživatel a anonymní uživatelé nemají povoleno měnit hesla"
dan "Du bruger MariaDB som anonym bruger. Anonyme brugere må ikke ændre adgangskoder"
nla "U gebruikt MariaDB als anonieme gebruiker en deze mogen geen wachtwoorden wijzigen"
eng "You are using MariaDB as an anonymous user and anonymous users are not allowed to change passwords"
eng "You are using MariaDB as an anonymous user and anonymous users are not allowed to modify user settings"
est "Te kasutate MariaDB-i anonüümse kasutajana, kelledel pole parooli muutmise õigust"
fre "Vous utilisez un utilisateur anonyme et les utilisateurs anonymes ne sont pas autorisés à changer les mots de passe"
ger "Sie benutzen MariaDB als anonymer Benutzer und dürfen daher keine Passwörter ändern"
......@@ -2946,7 +2946,7 @@ ER_PASSWORD_ANONYMOUS_USER 42000
jpn "MySQL を匿名ユーザーで使用しているので、パスワードの変更はできません。"
kor "당신은 MariaDB서버에 익명의 사용자로 접속을 하셨습니다.익명의 사용자는 암호를 변경할 수 없습니다."
por "Você está usando o MariaDB como usuário anônimo e usuários anônimos não têm permissão para mudar senhas"
rum "Dumneavoastra folositi MariaDB ca un utilizator anonim si utilizatorii anonimi nu au voie sa schimbe parolele"
rum "Dumneavoastra folositi MariaDB ca un utilizator anonim si utilizatorii anonimi nu au voie sa schimbe setarile utilizatorilor."
rus "Вы используете MariaDB от имени анонимного пользователя, а анонимным пользователям не разрешается менять пароли"
serbian "Vi koristite MariaDB kao anonimni korisnik a anonimnim korisnicima nije dozvoljeno da menjaju lozinke"
spa "Tu estás usando MariaDB como un usuario anonimo y usuarios anonimos no tienen permiso para cambiar las claves"
......@@ -7110,9 +7110,3 @@ ER_IT_IS_A_VIEW 42S02
eng "'%-.192s' is a view"
ER_SLAVE_SKIP_NOT_IN_GTID
eng "When using GTID, @@sql_slave_skip_counter can not be used. Instead, setting @@gtid_slave_pos explicitly can be used to skip to after a given GTID position."
ER_DEFAULT_ROLE_ANONYMOUS_USER
eng "You are using MariaDB as an anonymous user and anonymous users are not allowed to change default roles."
rum "Dumneavoastra folositi MariaDB ca un utilizator anonim si utilizatorii anonimi nu au voie sa schimbe rolurile implicite."
ER_NO_SUCH_ROLE
eng "The role specified '%-.64s' does not exist."
rum "Rolul specificat '%-.64s' nu există."
sql/sql_acl.cc
View file @ 64b27c73
This diff is collapsed.
sql/sql_acl.h
View file @ 64b27c73
......@@ -401,6 +401,9 @@ bool acl_check_proxy_grant_access (THD *thd, const char *host, const char *user,
bool with_grant);
int acl_setrole(THD *thd, char *rolename, ulonglong access);
int acl_check_setrole(THD *thd, char *rolename, ulonglong *access);
int acl_check_set_default_role(THD *thd, const char *host, const char *user);
int acl_set_default_role(THD *thd, const char *host, const char *user,
const char *rolename);
#ifndef DBUG_OFF
extern ulong role_global_merges, role_db_merges, role_table_merges,
......
sql/sql_yacc.yy
View file @ 64b27c73
......@@ -14667,10 +14667,39 @@ option_value_no_option_type:
MYSQL_YYABORT;
lex->var_list.push_back(var);
}
| DEFAULT ROLE_SYM grant_role
{
LEX *lex = Lex;
LEX_USER *user;
if (!(user=(LEX_USER *) thd->calloc(sizeof(LEX_USER))))
MYSQL_YYABORT;
user->user= current_user;
set_var_default_role *var= new set_var_default_role(user,
$3->user);
if (var == NULL)
MYSQL_YYABORT;
lex->var_list.push_back(var);
thd->lex->autocommit= TRUE;
if (lex->sphead)
lex->sphead->m_flags|= sp_head::HAS_SET_AUTOCOMMIT_STMT;
}
| DEFAULT ROLE_SYM grant_role FOR_SYM user
{
LEX *lex = Lex;
set_var_default_role *var= new set_var_default_role($5, $3->user);
if (var == NULL)
MYSQL_YYABORT;
lex->var_list.push_back(var);
thd->lex->autocommit= TRUE;
if (lex->sphead)
lex->sphead->m_flags|= sp_head::HAS_SET_AUTOCOMMIT_STMT;
}
| ROLE_SYM ident_or_text
{
LEX *lex = Lex;
set_var_role *var= new set_var_role($2);
if (var == NULL)
MYSQL_YYABORT;
lex->var_list.push_back(var);
}
| PASSWORD equal text_or_password
......@@ -14710,6 +14739,7 @@ option_value_no_option_type:
}
;
internal_variable_name:
ident
{
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7