Skip to content
Snippets Groups Projects
Commit c0ae52e8 authored by Kirill Shcherbatov's avatar Kirill Shcherbatov Committed by Kirill Yukhin
Browse files

sql: check access rights of table in VIEW

When access is performed using VIEW, access rights should be
checked against table[s] which it is referencing, not against
VIEW itself. Added a test case to verify this behaviour.

Closes #4104
parent 8e337858
No related branches found
No related tags found
No related merge requests found
box.execute("CREATE TABLE supersecret(id INT PRIMARY KEY, data TEXT);")
---
- row_count: 1
...
box.execute("CREATE TABLE supersecret2(id INT PRIMARY KEY, data TEXT);")
---
- row_count: 1
...
box.execute("INSERT INTO supersecret VALUES(1, 'very very big secret');")
---
- row_count: 1
...
box.execute("INSERT INTO supersecret2 VALUES(1, 'very big secret 2');")
---
- row_count: 1
...
box.execute("CREATE VIEW supersecret_leak AS SELECT * FROM supersecret, supersecret2;")
---
- row_count: 1
...
remote = require 'net.box'
---
...
cn = remote.connect(box.cfg.listen)
---
...
box.schema.user.grant('guest','read', 'space', 'SUPERSECRET_LEAK')
---
...
cn:execute('SELECT * FROM SUPERSECRET_LEAK')
---
- error: Read access to space 'SUPERSECRET' is denied for user 'guest'
...
box.schema.user.grant('guest','read', 'space', 'SUPERSECRET')
---
...
cn:execute('SELECT * FROM SUPERSECRET_LEAK')
---
- error: Read access to space 'SUPERSECRET2' is denied for user 'guest'
...
box.schema.user.revoke('guest','read', 'space', 'SUPERSECRET')
---
...
box.schema.user.revoke('guest','read', 'space', 'SUPERSECRET_LEAK')
---
...
box.execute("DROP VIEW supersecret_leak")
---
- row_count: 1
...
box.execute("DROP TABLE supersecret")
---
- row_count: 1
...
box.execute("DROP TABLE supersecret2")
---
- row_count: 1
...
box.execute("CREATE TABLE supersecret(id INT PRIMARY KEY, data TEXT);")
box.execute("CREATE TABLE supersecret2(id INT PRIMARY KEY, data TEXT);")
box.execute("INSERT INTO supersecret VALUES(1, 'very very big secret');")
box.execute("INSERT INTO supersecret2 VALUES(1, 'very big secret 2');")
box.execute("CREATE VIEW supersecret_leak AS SELECT * FROM supersecret, supersecret2;")
remote = require 'net.box'
cn = remote.connect(box.cfg.listen)
box.schema.user.grant('guest','read', 'space', 'SUPERSECRET_LEAK')
cn:execute('SELECT * FROM SUPERSECRET_LEAK')
box.schema.user.grant('guest','read', 'space', 'SUPERSECRET')
cn:execute('SELECT * FROM SUPERSECRET_LEAK')
box.schema.user.revoke('guest','read', 'space', 'SUPERSECRET')
box.schema.user.revoke('guest','read', 'space', 'SUPERSECRET_LEAK')
box.execute("DROP VIEW supersecret_leak")
box.execute("DROP TABLE supersecret")
box.execute("DROP TABLE supersecret2")
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment