Changeset: b0930bfdada7 for MonetDB
URL: https://dev.monetdb.org/hg/MonetDB?cmd=changeset;node=b0930bfdada7
Modified Files:
sql/server/sql_privileges.c
sql/test/BugDay_2005-11-09_2.9.3/Tests/grant_public.SF-1114580.stable.err
sql/test/BugDay_2005-11-09_2.9.3/Tests/schema_change_grant_crash.SF-963620.stable.err
sql/test/BugTracker-2010/Tests/crashonschema.Bug-2547.stable.err
sql/test/Users/Tests/grantPrivilegesNonDefaultRole.Bug-3365.stable.err
Branch: Apr2019
Log Message:
Use bool instead of int for static internal functions which return 0 or 1
Add "GRANT: " prefix to error messages which did not have it yet
Add "REVOKE: " prefix to error messages which did not have it yet
Improved layout of long if constructs in table_privs()
diffs (truncated from 328 to 300 lines):
diff --git a/sql/server/sql_privileges.c b/sql/server/sql_privileges.c
--- a/sql/server/sql_privileges.c
+++ b/sql/server/sql_privileges.c
@@ -67,13 +67,13 @@ sql_insert_all_privs(mvc *sql, sqlid aut
sql_insert_priv(sql, auth_id, obj_id, PRIV_TRUNCATE, grantor,
grantable);
}
-static int
+static bool
admin_privs(sqlid grantor)
{
if (grantor == USER_MONETDB || grantor == ROLE_SYSADMIN) {
- return 1;
+ return true;
}
- return 0;
+ return false;
}
int
@@ -107,20 +107,20 @@ sql_grant_global_privs( mvc *sql, char *
int allowed;
sqlid grantee_id;
- allowed = admin_privs(grantor);
+ allowed = admin_privs(grantor) ? 1 : 0;
if (!allowed)
allowed = sql_grantable(sql, grantor, GLOBAL_OBJID, privs, 0);
if (!allowed)
- throw(SQL,"sql.grant_global",SQLSTATE(0L000) "Grantor '%s' is
not allowed to grant global privileges", stack_get_string(sql,"current_user"));
+ throw(SQL,"sql.grant_global",SQLSTATE(0L000) "GRANT: Grantor
'%s' is not allowed to grant global privileges",
stack_get_string(sql,"current_user"));
grantee_id = sql_find_auth(sql, grantee);
if (grantee_id <= 0)
- throw(SQL,"sql.grant_global",SQLSTATE(42M32) "User/role '%s'
unknown", grantee);
+ throw(SQL,"sql.grant_global",SQLSTATE(42M32) "GRANT: User/role
'%s' unknown", grantee);
/* first check if privilege isn't already given */
if ((sql_privilege(sql, grantee_id, GLOBAL_OBJID, privs, 0)))
- throw(SQL,"sql.grant_global",SQLSTATE(42M32) "User/role '%s'
already has this privilege", grantee);
+ throw(SQL,"sql.grant_global",SQLSTATE(42M32) "GRANT: User/role
'%s' already has this privilege", grantee);
sql_insert_priv(sql, grantee_id, GLOBAL_OBJID, privs, grantor, grant);
tr->schema_updates++;
return MAL_SUCCEED;
@@ -137,12 +137,12 @@ sql_grant_table_privs( mvc *sql, char *g
sqlid grantee_id;
int all = PRIV_SELECT | PRIV_UPDATE | PRIV_INSERT | PRIV_DELETE |
PRIV_TRUNCATE;
- if (sname)
+ if (sname)
s = mvc_bind_schema(sql, sname);
if (s)
- t = mvc_bind_table(sql, s, tname);
+ t = mvc_bind_table(sql, s, tname);
if (!t)
- throw(SQL,"sql.grant_table",SQLSTATE(42S02) "GRANT no such
table '%s'", tname);
+ throw(SQL,"sql.grant_table",SQLSTATE(42S02) "GRANT: no such
table '%s'", tname);
allowed = schema_privs(grantor, t->s);
@@ -151,23 +151,23 @@ sql_grant_table_privs( mvc *sql, char *g
allowed = sql_grantable(sql, grantor, t->base.id,
privs, 0);
if (!allowed)
- throw(SQL,"sql.grant_table", SQLSTATE(0L000) "Grantor
'%s' is not allowed to grant privileges for table '%s'",
stack_get_string(sql,"current_user"), tname);
+ throw(SQL,"sql.grant_table", SQLSTATE(0L000) "GRANT:
Grantor '%s' is not allowed to grant privileges for table '%s'",
stack_get_string(sql,"current_user"), tname);
}
if (cname) {
c = mvc_bind_column(sql, t, cname);
if (!c)
- throw(SQL,"sql.grant_table",SQLSTATE(42S22) "Table %s
has no column %s", tname, cname);
+ throw(SQL,"sql.grant_table",SQLSTATE(42S22) "GRANT:
Table '%s' has no column '%s'", tname, cname);
/* allowed on column */
if (!allowed)
allowed = sql_grantable(sql, grantor, c->base.id,
privs, 0);
if (!allowed)
- throw(SQL, "sql.grant_table", SQLSTATE(0L000) "Grantor
%s is not allowed to grant privilege %s for table %s", stack_get_string(sql,
"current_user"), priv2string(privs), tname);
+ throw(SQL, "sql.grant_table", SQLSTATE(0L000) "GRANT:
Grantor '%s' is not allowed to grant privilege %s for table '%s'",
stack_get_string(sql, "current_user"), priv2string(privs), tname);
}
grantee_id = sql_find_auth(sql, grantee);
if (grantee_id <= 0)
- throw(SQL,"sql.grant_table", SQLSTATE(42M32) "User/role '%s'
unknown", grantee);
+ throw(SQL,"sql.grant_table", SQLSTATE(42M32) "GRANT: User/role
'%s' unknown", grantee);
/* first check if privilege isn't already given */
if ((privs == all &&
(sql_privilege(sql, grantee_id, t->base.id, PRIV_SELECT, 0) ||
@@ -177,7 +177,7 @@ sql_grant_table_privs( mvc *sql, char *g
sql_privilege(sql, grantee_id, t->base.id, PRIV_TRUNCATE, 0))) ||
(privs != all && !c && sql_privilege(sql, grantee_id, t->base.id,
privs, 0)) ||
(privs != all && c && sql_privilege(sql, grantee_id, c->base.id,
privs, 0))) {
- throw(SQL, "sql.grant", SQLSTATE(42M32) "User/role '%s' already
has this privilege", grantee);
+ throw(SQL, "sql.grant", SQLSTATE(42M32) "GRANT: User/role '%s'
already has this privilege", grantee);
}
if (privs == all) {
sql_insert_all_privs(sql, grantee_id, t->base.id, grantor,
grant);
@@ -199,7 +199,7 @@ sql_grant_func_privs( mvc *sql, char *gr
int allowed;
sqlid grantee_id;
- if (sname)
+ if (sname)
s = mvc_bind_schema(sql, sname);
if (s) {
node *n = find_sql_func_node(s, func_id);
@@ -213,14 +213,14 @@ sql_grant_func_privs( mvc *sql, char *gr
allowed = sql_grantable(sql, grantor, f->base.id, privs, 0);
if (!allowed)
- throw(SQL, "sql.grant_func", SQLSTATE(0L000) "Grantor '%s' is
not allowed to grant privileges for function '%s'",
stack_get_string(sql,"current_user"), f->base.name);
+ throw(SQL, "sql.grant_func", SQLSTATE(0L000) "GRANT: Grantor
'%s' is not allowed to grant privileges for function '%s'",
stack_get_string(sql,"current_user"), f->base.name);
grantee_id = sql_find_auth(sql, grantee);
if (grantee_id <= 0)
- throw(SQL, "sql.grant_func", SQLSTATE(42M32) "User/role '%s'
unknown", grantee);
+ throw(SQL, "sql.grant_func", SQLSTATE(42M32) "GRANT: User/role
'%s' unknown", grantee);
/* first check if privilege isn't already given */
if (sql_privilege(sql, grantee_id, f->base.id, privs, 0))
- throw(SQL,"sql.grant", SQLSTATE(42M32) "User/role '%s' already
has this privilege", grantee);
+ throw(SQL,"sql.grant", SQLSTATE(42M32) "GRANT: User/role '%s'
already has this privilege", grantee);
sql_insert_priv(sql, grantee_id, f->base.id, privs, grantor, grant);
tr->schema_updates++;
return NULL;
@@ -256,17 +256,17 @@ sql_revoke_global_privs( mvc *sql, char
int allowed;
sqlid grantee_id;
- allowed = admin_privs(grantor);
+ allowed = admin_privs(grantor) ? 1 : 0;
if (!allowed)
allowed = sql_grantable(sql, grantor, GLOBAL_OBJID, privs, 0);
if (!allowed)
- throw(SQL, "sql.revoke_global", SQLSTATE(0L000) "Grantor '%s'
is not allowed to revoke global privileges",
stack_get_string(sql,"current_user"));
+ throw(SQL, "sql.revoke_global", SQLSTATE(0L000) "REVOKE:
Grantor '%s' is not allowed to revoke global privileges",
stack_get_string(sql,"current_user"));
grantee_id = sql_find_auth(sql, grantee);
if (grantee_id <= 0)
- throw(SQL, "sql.revoke_global", SQLSTATE(42M32) "REVOKE:
user/role '%s' unknown", grantee);
+ throw(SQL, "sql.revoke_global", SQLSTATE(42M32) "REVOKE:
User/role '%s' unknown", grantee);
sql_delete_priv(sql, grantee_id, GLOBAL_OBJID, privs, grantor, grant);
sql->session->tr->schema_updates++;
return NULL;
@@ -282,35 +282,35 @@ sql_revoke_table_privs( mvc *sql, char *
sqlid grantee_id;
int all = PRIV_SELECT | PRIV_UPDATE | PRIV_INSERT | PRIV_DELETE |
PRIV_TRUNCATE;
- if (sname)
+ if (sname)
s = mvc_bind_schema(sql, sname);
if (s)
- t = mvc_bind_table(sql, s, tname);
+ t = mvc_bind_table(sql, s, tname);
if (!t)
- throw(SQL,"sql.revoke_table", SQLSTATE(42S02) "Revoke: no such
table '%s'", tname);
+ throw(SQL,"sql.revoke_table", SQLSTATE(42S02) "REVOKE: no such
table '%s'", tname);
allowed = schema_privs(grantor, t->s);
if (!allowed)
allowed = sql_grantable(sql, grantor, t->base.id, privs, 0);
if (!allowed)
- throw(SQL, "sql.revoke_table", SQLSTATE(0L000) "Grantor '%s' is
not allowed to revoke privileges for table '%s'",
stack_get_string(sql,"current_user"), tname);
+ throw(SQL, "sql.revoke_table", SQLSTATE(0L000) "REVOKE: Grantor
'%s' is not allowed to revoke privileges for table '%s'",
stack_get_string(sql,"current_user"), tname);
if (cname) {
c = mvc_bind_column(sql, t, cname);
if (!c)
- throw(SQL,"sql.revoke_table", SQLSTATE(42S22) "REVOKE:
table %s has no column %s", tname, cname);
+ throw(SQL,"sql.revoke_table", SQLSTATE(42S22) "REVOKE:
table '%s' has no column '%s'", tname, cname);
/* allowed on column */
if (!allowed)
allowed = sql_grantable(sql, grantor, c->base.id,
privs, 0);
if (!allowed)
- throw(SQL, "sql.revoke_table", SQLSTATE(0L000) "Grantor
%s is not allowed to revoke privilege %s for table %s", stack_get_string(sql,
"current_user"), priv2string(privs), tname);
+ throw(SQL, "sql.revoke_table", SQLSTATE(0L000) "REVOKE:
Grantor '%s' is not allowed to revoke privilege %s for table '%s'",
stack_get_string(sql, "current_user"), priv2string(privs), tname);
}
grantee_id = sql_find_auth(sql, grantee);
if (grantee_id <= 0)
- throw(SQL,"sql.revoke_table", SQLSTATE(42M32) "REVOKE:
user/role '%s' unknown", grantee);
+ throw(SQL,"sql.revoke_table", SQLSTATE(42M32) "REVOKE:
User/role '%s' unknown", grantee);
if (privs == all) {
sql_delete_priv(sql, grantee_id, t->base.id, PRIV_SELECT,
grantor, grant);
sql_delete_priv(sql, grantee_id, t->base.id, PRIV_UPDATE,
grantor, grant);
@@ -334,7 +334,7 @@ sql_revoke_func_privs( mvc *sql, char *g
int allowed;
sqlid grantee_id;
- if (sname)
+ if (sname)
s = mvc_bind_schema(sql, sname);
if (s) {
node *n = find_sql_func_node(s, func_id);
@@ -347,17 +347,17 @@ sql_revoke_func_privs( mvc *sql, char *g
allowed = sql_grantable(sql, grantor, f->base.id, privs, 0);
if (!allowed)
- throw(SQL, "sql.revoke_func", SQLSTATE(0L000) "Grantor '%s' is
not allowed to revoke privileges for function '%s'",
stack_get_string(sql,"current_user"), f->base.name);
+ throw(SQL, "sql.revoke_func", SQLSTATE(0L000) "REVOKE: Grantor
'%s' is not allowed to revoke privileges for function '%s'",
stack_get_string(sql,"current_user"), f->base.name);
grantee_id = sql_find_auth(sql, grantee);
if (grantee_id <= 0)
- throw(SQL, "sql.revoke_func", SQLSTATE(42M32) "REVOKE:
user/role '%s' unknown", grantee);
+ throw(SQL, "sql.revoke_func", SQLSTATE(42M32) "REVOKE:
User/role '%s' unknown", grantee);
sql_delete_priv(sql, grantee_id, f->base.id, privs, grantor, grant);
sql->session->tr->schema_updates++;
return NULL;
}
-static int
+static bool
sql_create_auth_id(mvc *m, sqlid id, str auth)
{
int grantor = 0; /* no grantor */
@@ -366,11 +366,11 @@ sql_create_auth_id(mvc *m, sqlid id, str
sql_column *auth_name = find_sql_column(auths, "name");
if (!is_oid_nil(table_funcs.column_find_row(m->session->tr, auth_name,
auth, NULL)))
- return FALSE;
+ return false;
table_funcs.table_insert(m->session->tr, auths, &id, auth, &grantor);
m->session->tr->schema_updates++;
- return TRUE;
+ return true;
}
str
@@ -451,9 +451,15 @@ int
table_privs(mvc *m, sql_table *t, int priv)
{
/* temporary tables are owned by the session user */
- if (t->persistence == SQL_DECLARED_TABLE || (!t->system &&
t->persistence != SQL_PERSIST) || (priv == PRIV_SELECT && (t->persistence !=
SQL_PERSIST || t->commit_action)))
+ if (t->persistence == SQL_DECLARED_TABLE ||
+ (!t->system && t->persistence != SQL_PERSIST) ||
+ (priv == PRIV_SELECT && (t->persistence != SQL_PERSIST ||
t->commit_action)))
return 1;
- if (admin_privs(m->user_id) || admin_privs(m->role_id) || (t->s &&
(m->user_id == t->s->auth_id || m->role_id == t->s->auth_id)) ||
sql_privilege(m, m->user_id, t->base.id, priv, 0) == priv || sql_privilege(m,
m->role_id, t->base.id, priv, 0) == priv || sql_privilege(m, ROLE_PUBLIC,
t->base.id, priv, 0) == priv) {
+ if (admin_privs(m->user_id) || admin_privs(m->role_id) ||
+ (t->s && (m->user_id == t->s->auth_id || m->role_id ==
t->s->auth_id)) ||
+ sql_privilege(m, m->user_id, t->base.id, priv, 0) == priv ||
+ sql_privilege(m, m->role_id, t->base.id, priv, 0) == priv ||
+ sql_privilege(m, ROLE_PUBLIC, t->base.id, priv, 0) == priv) {
return 1;
}
return 0;
@@ -475,7 +481,7 @@ execute_priv(mvc *m, sql_func *f)
return 0;
}
-static int
+static bool
role_granting_privs(mvc *m, oid role_rid, sqlid role_id, sqlid grantor_id)
{
sql_schema *sys = find_sql_schema(m->session->tr, "sys");
@@ -489,11 +495,11 @@ role_granting_privs(mvc *m, oid role_rid
_DELETE(val);
if (owner_id == grantor_id)
- return 1;
+ return true;
if (sql_privilege(m, grantor_id, role_id, PRIV_ROLE_ADMIN, 0))
- return 1;
+ return true;
/* check for grant rights in the privs table */
- return 0;
+ return false;
}
char *
diff --git
a/sql/test/BugDay_2005-11-09_2.9.3/Tests/grant_public.SF-1114580.stable.err
b/sql/test/BugDay_2005-11-09_2.9.3/Tests/grant_public.SF-1114580.stable.err
--- a/sql/test/BugDay_2005-11-09_2.9.3/Tests/grant_public.SF-1114580.stable.err
+++ b/sql/test/BugDay_2005-11-09_2.9.3/Tests/grant_public.SF-1114580.stable.err
@@ -12,11 +12,11 @@ stderr of test 'grant_public.SF-1114580`
MAPI = (monetdb) /var/tmp/mtest-15225/.s.monetdb.34050
QUERY = GRANT UPDATE(dumdum) ON test1114580 TO PUBLIC;
-ERROR = !Table test1114580 has no column dumdum
+ERROR = !GRANT: Table 'test1114580' has no column 'dumdum'
CODE = 42S22
MAPI = (monetdb) /var/tmp/mtest-30274/.s.monetdb.37685
QUERY = GRANT INSERT ON test1114580 TO PUBLIC;
-ERROR = !User/role 'public' already has this privilege
+ERROR = !GRANT: User/role 'public' already has this privilege
CODE = 42M32
MAPI = (monetdb) /var/tmp/mtest-30274/.s.monetdb.37685
QUERY = GRANT INSERT ON test1114580 TO PUBLIC;
diff --git
a/sql/test/BugDay_2005-11-09_2.9.3/Tests/schema_change_grant_crash.SF-963620.stable.err
b/sql/test/BugDay_2005-11-09_2.9.3/Tests/schema_change_grant_crash.SF-963620.stable.err
---
a/sql/test/BugDay_2005-11-09_2.9.3/Tests/schema_change_grant_crash.SF-963620.stable.err
+++
b/sql/test/BugDay_2005-11-09_2.9.3/Tests/schema_change_grant_crash.SF-963620.stable.err
@@ -12,7 +12,7 @@ stderr of test 'schema_change_grant_cras
MAPI = (monetdb) /var/tmp/mtest-32127/.s.monetdb.34402
QUERY = grant all on mine to monetdb;
-ERROR = !GRANT no such table 'mine'
_______________________________________________
checkin-list mailing list
[email protected]
https://www.monetdb.org/mailman/listinfo/checkin-list
