diff --git a/executor/revoke_test.go b/executor/revoke_test.go index 9607736a3ee65..92cd7d79517b6 100644 --- a/executor/revoke_test.go +++ b/executor/revoke_test.go @@ -92,7 +92,7 @@ func TestRevokeTableScope(t *testing.T) { // Make sure all the table privs for new user is Y. res := tk.MustQuery(`SELECT Table_priv FROM mysql.tables_priv WHERE User="testTblRevoke" and host="localhost" and db="test" and Table_name="test1"`) - res.Check(testkit.Rows("Select,Insert,Update,Delete,Create,Drop,Index,Alter,Create View,Show View,References")) + res.Check(testkit.Rows("Select,Insert,Update,Delete,Create,Drop,Index,Alter,Create View,Show View,Trigger,References")) // Revoke each priv from the user. for _, v := range mysql.AllTablePrivs { diff --git a/parser/mysql/privs.go b/parser/mysql/privs.go index 93e5db579ad1e..af1c453487a0e 100644 --- a/parser/mysql/privs.go +++ b/parser/mysql/privs.go @@ -77,6 +77,7 @@ var Priv2SetStr = map[PrivilegeType]string{ CreateRolePriv: "Create Role", DropRolePriv: "Drop Role", ShutdownPriv: "Shutdown Role", + TriggerPriv: "Trigger", } // SetStr2Priv is the map for privilege set string to privilege type. @@ -99,6 +100,7 @@ var SetStr2Priv = map[string]PrivilegeType{ "Index": IndexPriv, "Create View": CreateViewPriv, "Show View": ShowViewPriv, + "Trigger": TriggerPriv, } // Priv2UserCol is the privilege to mysql.user table column name. @@ -309,10 +311,10 @@ func (privs Privileges) Has(p PrivilegeType) bool { var AllGlobalPrivs = Privileges{SelectPriv, InsertPriv, UpdatePriv, DeletePriv, CreatePriv, DropPriv, ProcessPriv, ReferencesPriv, AlterPriv, ShowDBPriv, SuperPriv, ExecutePriv, IndexPriv, CreateUserPriv, CreateTablespacePriv, TriggerPriv, CreateViewPriv, ShowViewPriv, CreateRolePriv, DropRolePriv, CreateTMPTablePriv, LockTablesPriv, CreateRoutinePriv, AlterRoutinePriv, EventPriv, ShutdownPriv, ReloadPriv, FilePriv, ConfigPriv, ReplicationClientPriv, ReplicationSlavePriv} // AllDBPrivs is all the privileges in database scope. -var AllDBPrivs = Privileges{SelectPriv, InsertPriv, UpdatePriv, DeletePriv, CreatePriv, DropPriv, ReferencesPriv, LockTablesPriv, CreateTMPTablePriv, EventPriv, CreateRoutinePriv, AlterRoutinePriv, AlterPriv, ExecutePriv, IndexPriv, CreateViewPriv, ShowViewPriv} +var AllDBPrivs = Privileges{SelectPriv, InsertPriv, UpdatePriv, DeletePriv, CreatePriv, DropPriv, ReferencesPriv, LockTablesPriv, CreateTMPTablePriv, EventPriv, CreateRoutinePriv, AlterRoutinePriv, AlterPriv, ExecutePriv, IndexPriv, CreateViewPriv, ShowViewPriv, TriggerPriv} // AllTablePrivs is all the privileges in table scope. -var AllTablePrivs = Privileges{SelectPriv, InsertPriv, UpdatePriv, DeletePriv, CreatePriv, DropPriv, IndexPriv, ReferencesPriv, AlterPriv, CreateViewPriv, ShowViewPriv} +var AllTablePrivs = Privileges{SelectPriv, InsertPriv, UpdatePriv, DeletePriv, CreatePriv, DropPriv, IndexPriv, ReferencesPriv, AlterPriv, CreateViewPriv, ShowViewPriv, TriggerPriv} // AllColumnPrivs is all the privileges in column scope. var AllColumnPrivs = Privileges{SelectPriv, InsertPriv, UpdatePriv, ReferencesPriv} diff --git a/planner/core/logical_plan_test.go b/planner/core/logical_plan_test.go index 795f906ca0886..789a1cda0b90e 100644 --- a/planner/core/logical_plan_test.go +++ b/planner/core/logical_plan_test.go @@ -1151,6 +1151,7 @@ func TestVisitInfo(t *testing.T) { {mysql.IndexPriv, "test", "", "", nil, false, "", false}, {mysql.CreateViewPriv, "test", "", "", nil, false, "", false}, {mysql.ShowViewPriv, "test", "", "", nil, false, "", false}, + {mysql.TriggerPriv, "test", "", "", nil, false, "", false}, }, }, { @@ -1225,6 +1226,7 @@ func TestVisitInfo(t *testing.T) { {mysql.IndexPriv, "test", "", "", nil, false, "", false}, {mysql.CreateViewPriv, "test", "", "", nil, false, "", false}, {mysql.ShowViewPriv, "test", "", "", nil, false, "", false}, + {mysql.TriggerPriv, "test", "", "", nil, false, "", false}, }, }, { diff --git a/privilege/privileges/cache.go b/privilege/privileges/cache.go index 990a6deabef67..4e6d4633d0832 100644 --- a/privilege/privileges/cache.go +++ b/privilege/privileges/cache.go @@ -54,7 +54,7 @@ const globalDBVisible = mysql.CreatePriv | mysql.SelectPriv | mysql.InsertPriv | const ( sqlLoadRoleGraph = "SELECT HIGH_PRIORITY FROM_USER, FROM_HOST, TO_USER, TO_HOST FROM mysql.role_edges" sqlLoadGlobalPrivTable = "SELECT HIGH_PRIORITY Host,User,Priv FROM mysql.global_priv" - sqlLoadDBTable = "SELECT HIGH_PRIORITY Host,DB,User,Select_priv,Insert_priv,Update_priv,Delete_priv,Create_priv,Drop_priv,Grant_priv,Index_priv,References_priv,Lock_tables_priv,Create_tmp_table_priv,Event_priv,Create_routine_priv,Alter_routine_priv,Alter_priv,Execute_priv,Create_view_priv,Show_view_priv FROM mysql.db ORDER BY host, db, user" + sqlLoadDBTable = "SELECT HIGH_PRIORITY Host,DB,User,Select_priv,Insert_priv,Update_priv,Delete_priv,Create_priv,Drop_priv,Grant_priv,Index_priv,References_priv,Lock_tables_priv,Create_tmp_table_priv,Event_priv,Create_routine_priv,Alter_routine_priv,Alter_priv,Execute_priv,Create_view_priv,Show_view_priv,Trigger_priv FROM mysql.db ORDER BY host, db, user" sqlLoadTablePrivTable = "SELECT HIGH_PRIORITY Host,DB,User,Table_name,Grantor,Timestamp,Table_priv,Column_priv FROM mysql.tables_priv" sqlLoadColumnsPrivTable = "SELECT HIGH_PRIORITY Host,DB,User,Table_name,Column_name,Timestamp,Column_priv FROM mysql.columns_priv" sqlLoadDefaultRoles = "SELECT HIGH_PRIORITY HOST, USER, DEFAULT_ROLE_HOST, DEFAULT_ROLE_USER FROM mysql.default_roles" diff --git a/privilege/privileges/privileges_test.go b/privilege/privileges/privileges_test.go index aff95b033732c..a59c4c79f3c0e 100644 --- a/privilege/privileges/privileges_test.go +++ b/privilege/privileges/privileges_test.go @@ -2888,6 +2888,22 @@ func TestSkipGrantTable(t *testing.T) { tk.MustExec(`GRANT RESTRICTED_USER_ADMIN ON *.* TO 'test2'@'%';`) } +// https://github.com/pingcap/tidb/issues/32891 +func TestIncorrectUsageDBGrant(t *testing.T) { + store, clean := createStoreAndPrepareDB(t) + defer clean() + + tk := testkit.NewTestKit(t, store) + tk.MustExec(`CREATE USER ucorrect1, ucorrect2;`) + tk.MustExec(`CREATE TABLE test.trigger_table (a int)`) + tk.MustExec(`GRANT CREATE TEMPORARY TABLES,DELETE,EXECUTE,INSERT,SELECT,SHOW VIEW,TRIGGER,UPDATE ON test.* TO ucorrect1;`) + tk.MustExec(`GRANT TRIGGER ON test.trigger_table TO ucorrect2;`) + tk.MustExec(`DROP TABLE test.trigger_table`) + + err := tk.ExecToErr(`GRANT CREATE TEMPORARY TABLES,DELETE,EXECUTE,INSERT,SELECT,SHOW VIEW,TRIGGER,UPDATE ON test.* TO uincorrect;`) + require.EqualError(t, err, "[executor:1410]You are not allowed to create a user with GRANT") +} + func TestIssue29823(t *testing.T) { store, clean := createStoreAndPrepareDB(t) defer clean()