[
https://issues.apache.org/jira/browse/IGNITE-6856?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16423838#comment-16423838
]
Vladimir Ozerov commented on IGNITE-6856:
-----------------------------------------
Apparently, the problem is deeper than I thought in the first place.
1) SQL permissions have never worked correctly. If query is executed through
cache API, then we only check permissions against this cache. It means, that if
one has read permission to one cache, it could be used as a "window" for all
other caches.
2) Our new DML and DDL commands are not integrated into security circuit anyhow
at the moment. They require different checks and permissions comparing to
{{SELECT}} statements. Also note that with DDL we need to have completely new
permissions for {{CREATE/DROP INDEX}}.
> SQL: invalid security checks during query execution
> ---------------------------------------------------
>
> Key: IGNITE-6856
> URL: https://issues.apache.org/jira/browse/IGNITE-6856
> Project: Ignite
> Issue Type: Bug
> Components: cache, sql
> Affects Versions: 2.3
> Reporter: Vladimir Ozerov
> Priority: Major
> Fix For: 2.5
>
>
> Currently security check is performed inside {{IgniteCacheProxy}}. This is
> wrong place. Instead, we should perform it inside query processor after
> parsing when all affected caches are known.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
