Skip to content

Commit ebc9bbb

Browse files
an3lan3l
committed
MDEV-22313: Neither SHOW CREATE USER nor SHOW GRANTS prints a user's default role
1 parent 985ede9 commit ebc9bbb

File tree

7 files changed

+104
-8
lines changed

7 files changed

+104
-8
lines changed

‎mysql-test/r/grant5.result‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,3 +39,35 @@ connection default;
3939
disconnect u1;
4040
drop user u1@localhost;
4141
drop database mysqltest1;
42+
CREATE ROLE test_role;
43+
CREATE USER test_user;
44+
GRANT test_role TO test_user;
45+
SET DEFAULT ROLE test_role FOR test_user;
46+
SHOW GRANTS FOR test_user;
47+
Grants for test_user@%
48+
GRANT test_role TO 'test_user'@'%'
49+
GRANT USAGE ON *.* TO 'test_user'@'%'
50+
SET DEFAULT ROLE test_role FOR 'test_user'@'%'
51+
SET DEFAULT ROLE NONE for test_user;
52+
SHOW GRANTS FOR test_user;
53+
Grants for test_user@%
54+
GRANT test_role TO 'test_user'@'%'
55+
GRANT USAGE ON *.* TO 'test_user'@'%'
56+
SET ROLE test_role;
57+
SET DEFAULT ROLE test_role;
58+
SHOW GRANTS;
59+
Grants for root@localhost
60+
GRANT test_role TO 'root'@'localhost' WITH ADMIN OPTION
61+
GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION
62+
GRANT PROXY ON ''@'%' TO 'root'@'localhost' WITH GRANT OPTION
63+
GRANT USAGE ON *.* TO 'test_role'
64+
SET DEFAULT ROLE test_role FOR 'root'@'localhost'
65+
SET DEFAULT ROLE NONE;
66+
SHOW GRANTS;
67+
Grants for root@localhost
68+
GRANT test_role TO 'root'@'localhost' WITH ADMIN OPTION
69+
GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION
70+
GRANT PROXY ON ''@'%' TO 'root'@'localhost' WITH GRANT OPTION
71+
GRANT USAGE ON *.* TO 'test_role'
72+
DROP USER test_user;
73+
DROP ROLE test_role;

‎mysql-test/suite/roles/set_default_role_clear.result‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ Grants for test_user@localhost
1717
GRANT test_role TO 'test_user'@'localhost'
1818
GRANT USAGE ON *.* TO 'test_user'@'localhost'
1919
GRANT SELECT ON *.* TO 'test_role'
20+
SET DEFAULT ROLE test_role FOR 'test_user'@'localhost'
2021
select user, host, default_role from mysql.user where user='test_user';
2122
user host default_role
2223
test_user localhost test_role

‎mysql-test/suite/roles/set_default_role_for.result‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ Grants for user_a@localhost
2121
GRANT role_a TO 'user_a'@'localhost'
2222
GRANT USAGE ON *.* TO 'user_a'@'localhost'
2323
GRANT SELECT ON *.* TO 'role_a'
24+
SET DEFAULT ROLE role_a FOR 'user_a'@'localhost'
2425
select user, host, default_role from mysql.user where user like 'user_%';
2526
user host default_role
2627
user_a localhost role_a
@@ -42,6 +43,7 @@ Grants for user_b@localhost
4243
GRANT role_b TO 'user_b'@'localhost'
4344
GRANT USAGE ON *.* TO 'user_b'@'localhost'
4445
GRANT INSERT, UPDATE ON *.* TO 'role_b'
46+
SET DEFAULT ROLE role_b FOR 'user_b'@'localhost'
4547
select user, host, default_role from mysql.user where user like 'user_%';
4648
ERROR 42000: SELECT command denied to user 'user_b'@'localhost' for table 'user'
4749
insert ignore into mysql.user (user, host) values ('someuser', 'somehost');

‎mysql-test/suite/roles/set_default_role_invalid.result‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ Grants for test_user@localhost
2424
GRANT test_role TO 'test_user'@'localhost'
2525
GRANT USAGE ON *.* TO 'test_user'@'localhost'
2626
GRANT SELECT ON *.* TO 'test_role'
27+
SET DEFAULT ROLE test_role FOR 'test_user'@'localhost'
2728
select user, host, default_role from mysql.user where user='test_user';
2829
user host default_role
2930
test_user localhost test_role
@@ -71,6 +72,7 @@ GRANT r1 TO 'b'@'%'
7172
GRANT r2 TO 'b'@'%'
7273
GRANT USAGE ON *.* TO 'b'@'%'
7374
GRANT SELECT ON `mysql`.* TO 'b'@'%'
75+
SET DEFAULT ROLE r2 FOR 'b'@'%'
7476
SET DEFAULT ROLE r1 FOR a;
7577
ERROR 42000: Access denied for user 'b'@'%' to database 'mysql'
7678
SELECT CURRENT_ROLE;
@@ -96,6 +98,7 @@ GRANT r1 TO 'b'@'%'
9698
GRANT r2 TO 'b'@'%'
9799
GRANT USAGE ON *.* TO 'b'@'%'
98100
GRANT SELECT, UPDATE ON `mysql`.* TO 'b'@'%'
101+
SET DEFAULT ROLE r2 FOR 'b'@'%'
99102
SET DEFAULT ROLE r1 FOR a;
100103
ERROR OP000: User `a@%` has not been granted role `r1`
101104
SET DEFAULT ROLE invalid_role;

‎mysql-test/suite/roles/set_default_role_new_connection.result‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ Grants for test_user@localhost
2323
GRANT test_role TO 'test_user'@'localhost'
2424
GRANT USAGE ON *.* TO 'test_user'@'localhost'
2525
GRANT SELECT ON *.* TO 'test_role'
26+
SET DEFAULT ROLE test_role FOR 'test_user'@'localhost'
2627
select user, host, default_role from mysql.user where user = 'test_user';
2728
user host default_role
2829
test_user localhost test_role
@@ -51,6 +52,7 @@ Grants for test_user@localhost
5152
GRANT test_role TO 'test_user'@'localhost'
5253
GRANT USAGE ON *.* TO 'test_user'@'localhost'
5354
GRANT SELECT ON *.* TO 'test_role'
55+
SET DEFAULT ROLE test_role FOR 'test_user'@'localhost'
5456
select user, host, default_role from mysql.user where user = 'test_user';
5557
user host default_role
5658
test_user localhost test_role

‎mysql-test/t/grant5.test‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,24 @@ disconnect u1;
5252
drop user u1@localhost;
5353
drop database mysqltest1;
5454

55+
#
56+
# MDEV-22313: Neither SHOW CREATE USER nor SHOW GRANTS prints a user's default role
57+
#
58+
CREATE ROLE test_role;
59+
CREATE USER test_user;
60+
GRANT test_role TO test_user;
61+
SET DEFAULT ROLE test_role FOR test_user;
62+
SHOW GRANTS FOR test_user;
63+
SET DEFAULT ROLE NONE for test_user;
64+
SHOW GRANTS FOR test_user;
65+
SET ROLE test_role;
66+
SET DEFAULT ROLE test_role;
67+
SHOW GRANTS;
68+
SET DEFAULT ROLE NONE;
69+
SHOW GRANTS;
70+
DROP USER test_user;
71+
DROP ROLE test_role;
72+
5573
#
5674
# End of 10.1 tests
5775
#

‎sql/sql_acl.cc‎

Lines changed: 46 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -353,8 +353,9 @@ static void update_hostname(acl_host_and_ip *host, const char *hostname);
353353
static ulong get_sort(uint count,...);
354354
static bool show_proxy_grants (THD *, const char *, const char *,
355355
char *, size_t);
356-
static bool show_role_grants(THD *, const char *, const char *,
356+
static bool show_role_grants(THD *, const char *,
357357
ACL_USER_BASE *, char *, size_t);
358+
static bool show_default_role(THD *, ACL_USER *, char *, size_t);
358359
static bool show_global_privileges(THD *, ACL_USER_BASE *,
359360
bool, char *, size_t);
360361
static bool show_database_privileges(THD *, const char *, const char *,
@@ -8531,7 +8532,7 @@ static bool print_grants_for_role(THD *thd, ACL_ROLE * role)
85318532
{
85328533
char buff[1024];
85338534

8534-
if (show_role_grants(thd, role->user.str, "", role, buff, sizeof(buff)))
8535+
if (show_role_grants(thd, "", role, buff, sizeof(buff)))
85358536
return TRUE;
85368537

85378538
if (show_global_privileges(thd, role, TRUE, buff, sizeof(buff)))
@@ -8746,7 +8747,7 @@ bool mysql_show_grants(THD *thd, LEX_USER *lex_user)
87468747
}
87478748

87488749
/* Show granted roles to acl_user */
8749-
if (show_role_grants(thd, username, hostname, acl_user, buff, sizeof(buff)))
8750+
if (show_role_grants(thd, hostname, acl_user, buff, sizeof(buff)))
87508751
goto end;
87518752

87528753
/* Add first global access grants */
@@ -8795,6 +8796,14 @@ bool mysql_show_grants(THD *thd, LEX_USER *lex_user)
87958796
}
87968797
}
87978798

8799+
if (username)
8800+
{
8801+
/* Show default role to acl_user */
8802+
if (show_default_role(thd, acl_user, buff, sizeof(buff)))
8803+
goto end;
8804+
}
8805+
8806+
87988807
error= 0;
87998808
end:
88008809
mysql_mutex_unlock(&acl_cache->lock);
@@ -8821,15 +8830,44 @@ static ROLE_GRANT_PAIR *find_role_grant_pair(const LEX_STRING *u,
88218830
my_hash_search(&acl_roles_mappings, (uchar*)pair_key.ptr(), key_length);
88228831
}
88238832

8824-
static bool show_role_grants(THD *thd, const char *username,
8825-
const char *hostname, ACL_USER_BASE *acl_entry,
8833+
static bool show_default_role(THD *thd, ACL_USER *acl_entry,
8834+
char *buff, size_t buffsize)
8835+
{
8836+
Protocol *protocol= thd->protocol;
8837+
LEX_STRING def_rolename= acl_entry->default_rolename;
8838+
8839+
if (def_rolename.length)
8840+
{
8841+
String def_str(buff, buffsize, system_charset_info);
8842+
def_str.length(0);
8843+
def_str.append(STRING_WITH_LEN("SET DEFAULT ROLE "));
8844+
def_str.append(&def_rolename);
8845+
def_str.append(" FOR '");
8846+
def_str.append(&acl_entry->user);
8847+
DBUG_ASSERT(!(acl_entry->flags & IS_ROLE));
8848+
def_str.append(STRING_WITH_LEN("'@'"));
8849+
def_str.append(acl_entry->host.hostname, acl_entry->hostname_length,
8850+
system_charset_info);
8851+
def_str.append('\'');
8852+
protocol->prepare_for_resend();
8853+
protocol->store(def_str.ptr(),def_str.length(),def_str.charset());
8854+
if (protocol->write())
8855+
{
8856+
return TRUE;
8857+
}
8858+
}
8859+
return FALSE;
8860+
}
8861+
8862+
static bool show_role_grants(THD *thd, const char *hostname,
8863+
ACL_USER_BASE *acl_entry,
88268864
char *buff, size_t buffsize)
88278865
{
88288866
uint counter;
88298867
Protocol *protocol= thd->protocol;
88308868
LEX_STRING host= {const_cast<char*>(hostname), strlen(hostname)};
88318869

8832-
String grant(buff,sizeof(buff),system_charset_info);
8870+
String grant(buff, buffsize, system_charset_info);
88338871
for (counter= 0; counter < acl_entry->role_grants.elements; counter++)
88348872
{
88358873
grant.length(0);
@@ -8873,7 +8911,7 @@ static bool show_global_privileges(THD *thd, ACL_USER_BASE *acl_entry,
88738911
ulong want_access;
88748912
Protocol *protocol= thd->protocol;
88758913

8876-
String global(buff,sizeof(buff),system_charset_info);
8914+
String global(buff, buffsize, system_charset_info);
88778915
global.length(0);
88788916
global.append(STRING_WITH_LEN("GRANT "));
88798917

@@ -8952,7 +8990,7 @@ static bool show_database_privileges(THD *thd, const char *username,
89528990
want_access=acl_db->initial_access;
89538991
if (want_access)
89548992
{
8955-
String db(buff,sizeof(buff),system_charset_info);
8993+
String db(buff, buffsize, system_charset_info);
89568994
db.length(0);
89578995
db.append(STRING_WITH_LEN("GRANT "));
89588996

0 commit comments

Comments
 (0)