scl.epp (Firebird-3.0.2.32703-0.tar.bz2) | : | scl.epp (Firebird-3.0.4.33054-0.tar.bz2) | ||
---|---|---|---|---|
skipping to change at line 214 | skipping to change at line 214 | |||
************************************** | ************************************** | |||
* | * | |||
* Functional description | * Functional description | |||
* Check security class for desired permission. Check first that | * Check security class for desired permission. Check first that | |||
* the desired access has been granted to the database then to the | * the desired access has been granted to the database then to the | |||
* object in question. | * object in question. | |||
* | * | |||
**************************************/ | **************************************/ | |||
SET_TDBB(tdbb); | SET_TDBB(tdbb); | |||
if (tdbb->tdbb_flags & TDBB_trusted_ddl) | // RS: SCL_references must be checked for DDL operation of index creation | |||
// and we need to ignore TDBB_trusted_ddl flag in this case. | ||||
// More general solution is to remove TDBB_trusted_dll flag since its pur | ||||
pose to | ||||
// allow system table modification due DDL operations. It requires removi | ||||
ng SCL_checks | ||||
// from VIO_{store,erase,motify}. It's quite possible but not so trivial | ||||
as at fist look. | ||||
if ((tdbb->tdbb_flags & TDBB_trusted_ddl) && (mask != SCL_references)) | ||||
return; | return; | |||
if (s_class && (s_class->scl_flags & SCL_corrupt)) | if (s_class && (s_class->scl_flags & SCL_corrupt)) | |||
{ | { | |||
ERR_post(Arg::Gds(isc_no_priv) << Arg::Str("(ACL unrecognized)") << | ERR_post(Arg::Gds(isc_no_priv) << Arg::Str("(ACL unrecognized)") << | |||
Arg::Str("security_class") << | Arg::Str("security_class") << | |||
Arg::Str(s_class->scl_name)); | Arg::Str(s_class->scl_name)); | |||
} | } | |||
const Jrd::Attachment& attachment = *tdbb->getAttachment(); | const Jrd::Attachment& attachment = *tdbb->getAttachment(); | |||
skipping to change at line 283 | skipping to change at line 288 | |||
* | * | |||
* S C L _ c h e c k _ c r e a t e _ a c c e s s | * S C L _ c h e c k _ c r e a t e _ a c c e s s | |||
* | * | |||
************************************** | ************************************** | |||
* | * | |||
* Functional description | * Functional description | |||
* Check create access on a database object (DDL access) | * Check create access on a database object (DDL access) | |||
* | * | |||
**************************************/ | **************************************/ | |||
SET_TDBB(tdbb); | SET_TDBB(tdbb); | |||
Jrd::Attachment* const attachment = tdbb->getAttachment(); | ||||
// Allow the locksmith any access to database | ||||
if (attachment->locksmith()) | ||||
return; | ||||
const SecurityClass::flags_t obj_mask = SCL_get_object_mask(type); | const SecurityClass::flags_t obj_mask = SCL_get_object_mask(type); | |||
if (!(obj_mask & SCL_create)) | if (!(obj_mask & SCL_create)) | |||
ERR_post(Arg::Gds(isc_dyn_no_priv)); | ERR_post(Arg::Gds(isc_dyn_no_priv)); | |||
} | } | |||
void SCL_check_charset(thread_db* tdbb, const MetaName& name, SecurityClass::fla gs_t mask) | void SCL_check_charset(thread_db* tdbb, const MetaName& name, SecurityClass::fla gs_t mask) | |||
{ | { | |||
/************************************** | /************************************** | |||
skipping to change at line 1197 | skipping to change at line 1207 | |||
* | * | |||
**************************************/ | **************************************/ | |||
SET_TDBB(tdbb); | SET_TDBB(tdbb); | |||
SecurityClass* s_class = SCL_get_class(tdbb, string); | SecurityClass* s_class = SCL_get_class(tdbb, string); | |||
if (!s_class) { | if (!s_class) { | |||
return NULL; | return NULL; | |||
} | } | |||
s_class->scl_flags = compute_access(tdbb, s_class, NULL, 0, NULL); | s_class->scl_flags = compute_access(tdbb, s_class, NULL, 0, NULL); | |||
s_class->scl_blb_access = SecurityClass::BA_UNKNOWN; | ||||
if (s_class->scl_flags & SCL_exists) { | if (s_class->scl_flags & SCL_exists) { | |||
return s_class; | return s_class; | |||
} | } | |||
// Class no long exists - get rid of it! | // Class no long exists - get rid of it! | |||
const Firebird::MetaName m_string(string); | const Firebird::MetaName m_string(string); | |||
SecurityClassList* list = tdbb->getAttachment()->att_security_classes; | SecurityClassList* list = tdbb->getAttachment()->att_security_classes; | |||
if (list && list->locate(m_string)) | if (list && list->locate(m_string)) | |||
skipping to change at line 1679 | skipping to change at line 1690 | |||
return privilege; | return privilege; | |||
} | } | |||
void Jrd::UserId::populateDpb(Firebird::ClumpletWriter& dpb) | void Jrd::UserId::populateDpb(Firebird::ClumpletWriter& dpb) | |||
{ | { | |||
if (usr_auth_block.hasData()) | if (usr_auth_block.hasData()) | |||
dpb.insertBytes(isc_dpb_auth_block, usr_auth_block.begin(), usr_a uth_block.getCount()); | dpb.insertBytes(isc_dpb_auth_block, usr_auth_block.begin(), usr_a uth_block.getCount()); | |||
else | else | |||
dpb.insertString(isc_dpb_user_name, usr_user_name); | dpb.insertString(isc_dpb_user_name, usr_user_name); | |||
if (!usr_sql_role_name.empty()) | ||||
dpb.insertString(isc_dpb_sql_role_name, usr_sql_role_name); | ||||
} | } | |||
End of changes. 4 change blocks. | ||||
1 lines changed or deleted | 18 lines changed or added |