[
https://issues.apache.org/jira/browse/DERBY-4191?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12780202#action_12780202
]
Rick Hillegas commented on DERBY-4191:
--------------------------------------
Hi Mamta,
Without seeing how the method is used it is hard to comment. However, I think
you are trying to capture the sense of "The absolutely minimal set of
permissions needed to SELECT from a table." That is my sense of what is meant
by part 2, section 7.6 <table reference>, access rule 1.ii.1.B. So a better
name for your proposed method may be getMinimalSelectPermissionsList().
Another way to tackle this might be to invent a new kind of permission which
can't be granted but which can be used internally: a MINIMAL_SELECT_PRIVILEGE
for tables. This solution would look something like the following:
o At bind time, you would add a MINIMAL_SELECT_PRIVILEGE( T ) to the list of
required table privileges for every table T that is selected from.
o For extra credit, this privilege could be removed from the list for any table
which has other required SELECT privileges. That removal might happen during
bind() or maybe during code generation. Alternatively, you could wait till
execution time to short-circuit the check for this privilege.
o At execution time, you would then do what I think you're planning on: If you
see a MINIMAL_SELECT_PRIVILEGE required for a table, you would check whether
the user/currentRole enjoys a table-wide SELECT privilege or SELECT privilege
on at least one column.
Thanks,
-Rick
> Lack of SELECT privilege does not prevent SELECT COUNT(*)
> ---------------------------------------------------------
>
> Key: DERBY-4191
> URL: https://issues.apache.org/jira/browse/DERBY-4191
> Project: Derby
> Issue Type: Bug
> Components: SQL
> Affects Versions: 10.4.2.0, 10.5.1.1
> Reporter: Knut Anders Hatlen
> Attachments: repro.sql
>
>
> A user that does not have SELECT privilege on a table can still perform a
> SELECT COUNT(*) on that table. Counting a specific column (e.g., SELECT
> COUNT(X)) is prevented.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
