Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit a90c3f6

Browse filesBrowse files
zddrzddr
committed
[fix](auth)Fix the need for low-level table permissions when querying views in certain situations (apache#44621)
fix when `create view v1 as select * from table1 union select * from table2` and user has select_priv of v1,but he can not `select * from v1` Fix the need for low-level table permissions when querying views in certain situations
1 parent 5f952cf commit a90c3f6
Copy full SHA for a90c3f6

File tree

Expand file treeCollapse file tree

3 files changed

+104
-1
lines changed
Filter options
Expand file treeCollapse file tree

3 files changed

+104
-1
lines changed

‎fe/fe-core/src/main/java/org/apache/doris/nereids/StatementContext.java

Copy file name to clipboardExpand all lines: fe/fe-core/src/main/java/org/apache/doris/nereids/StatementContext.java
+10Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,8 @@ public class StatementContext implements Closeable {
171171

172172
private final Map<MvccTableInfo, MvccSnapshot> snapshots = Maps.newHashMap();
173173

174+
private boolean privChecked;
175+
174176
public StatementContext() {
175177
this(ConnectContext.get(), null, 0);
176178
}
@@ -578,4 +580,12 @@ public TableId getTableId(TableIf tableIf) {
578580
this.tableIdMapping.put(tableIdentifier, tableId);
579581
return tableId;
580582
}
583+
584+
public boolean isPrivChecked() {
585+
return privChecked;
586+
}
587+
588+
public void setPrivChecked(boolean privChecked) {
589+
this.privChecked = privChecked;
590+
}
581591
}

‎fe/fe-core/src/main/java/org/apache/doris/nereids/rules/rewrite/CheckPrivileges.java

Copy file name to clipboardExpand all lines: fe/fe-core/src/main/java/org/apache/doris/nereids/rules/rewrite/CheckPrivileges.java
+5-1Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,13 @@ public class CheckPrivileges extends ColumnPruning {
4949

5050
@Override
5151
public Plan rewriteRoot(Plan plan, JobContext jobContext) {
52+
// Only enter once, if repeated, the permissions of the table in the view will be checked
53+
if (jobContext.getCascadesContext().getStatementContext().isPrivChecked()) {
54+
return plan;
55+
}
5256
this.jobContext = jobContext;
5357
super.rewriteRoot(plan, jobContext);
54-
58+
jobContext.getCascadesContext().getStatementContext().setPrivChecked(true);
5559
// don't rewrite plan
5660
return plan;
5761
}

‎regression-test/suites/auth_p0/test_select_view_auth.groovy

Copy file name to clipboard
+89Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
18+
suite("test_select_view_auth","p0,auth") {
19+
String suiteName = "test_select_view_auth"
20+
String user = "${suiteName}_user"
21+
String pwd = 'C123_567p'
22+
String dbName = "${suiteName}_db"
23+
String tableName1 = "${suiteName}_table1"
24+
String tableName2 = "${suiteName}_table2"
25+
String viewName = "${suiteName}_view"
26+
27+
try_sql("drop user ${user}")
28+
try_sql """drop table if exists ${dbName}.${tableName1}"""
29+
try_sql """drop table if exists ${dbName}.${tableName2}"""
30+
try_sql """drop view if exists ${dbName}.${viewName}"""
31+
sql """drop database if exists ${dbName}"""
32+
33+
sql """create user '${user}' IDENTIFIED by '${pwd}'"""
34+
35+
//cloud-mode
36+
if (isCloudMode()) {
37+
def clusters = sql " SHOW CLUSTERS; "
38+
assertTrue(!clusters.isEmpty())
39+
def validCluster = clusters[0][0]
40+
sql """GRANT USAGE_PRIV ON CLUSTER ${validCluster} TO ${user}""";
41+
}
42+
sql """create database ${dbName}"""
43+
sql("""use ${dbName}""")
44+
sql """
45+
CREATE TABLE IF NOT EXISTS ${dbName}.`${tableName1}` (
46+
id BIGINT,
47+
username VARCHAR(20)
48+
)
49+
DISTRIBUTED BY HASH(id) BUCKETS 2
50+
PROPERTIES (
51+
"replication_num" = "1"
52+
);
53+
"""
54+
55+
sql """
56+
CREATE TABLE IF NOT EXISTS ${dbName}.`${tableName2}` (
57+
id BIGINT,
58+
username VARCHAR(20)
59+
)
60+
DISTRIBUTED BY HASH(id) BUCKETS 2
61+
PROPERTIES (
62+
"replication_num" = "1"
63+
);
64+
"""
65+
66+
sql """create view ${dbName}.${viewName} as select * from ${dbName}.${tableName1} union select * from ${dbName}.${tableName2};"""
67+
68+
sql """grant select_priv on regression_test to ${user}"""
69+
70+
// table column
71+
connect(user=user, password="${pwd}", url=context.config.jdbcUrl) {
72+
try {
73+
sql "select * from ${dbName}.${viewName}"
74+
} catch (Exception e) {
75+
log.info(e.getMessage())
76+
assertTrue(e.getMessage().contains("denied"))
77+
}
78+
}
79+
sql """grant select_priv on ${dbName}.${viewName} to ${user}"""
80+
connect(user=user, password="${pwd}", url=context.config.jdbcUrl) {
81+
sql "select * from ${dbName}.${viewName}"
82+
}
83+
84+
try_sql("drop user ${user}")
85+
try_sql """drop table if exists ${dbName}.${tableName1}"""
86+
try_sql """drop table if exists ${dbName}.${tableName2}"""
87+
try_sql """drop view if exists ${dbName}.${viewName}"""
88+
sql """drop database if exists ${dbName}"""
89+
}

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.