From derby-dev-return-61276-apmail-db-derby-dev-archive=db.apache.org@db.apache.org Tue Jul 01 13:57:07 2008 Return-Path: Delivered-To: apmail-db-derby-dev-archive@www.apache.org Received: (qmail 60718 invoked from network); 1 Jul 2008 13:57:07 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2) by minotaur.apache.org with SMTP; 1 Jul 2008 13:57:07 -0000 Received: (qmail 37731 invoked by uid 500); 1 Jul 2008 13:57:07 -0000 Delivered-To: apmail-db-derby-dev-archive@db.apache.org Received: (qmail 37704 invoked by uid 500); 1 Jul 2008 13:57:07 -0000 Mailing-List: contact derby-dev-help@db.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: Delivered-To: mailing list derby-dev@db.apache.org Received: (qmail 37658 invoked by uid 99); 1 Jul 2008 13:57:07 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 01 Jul 2008 06:57:07 -0700 X-ASF-Spam-Status: No, hits=-2000.0 required=10.0 tests=ALL_TRUSTED X-Spam-Check-By: apache.org Received: from [140.211.11.140] (HELO brutus.apache.org) (140.211.11.140) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 01 Jul 2008 13:56:24 +0000 Received: from brutus (localhost [127.0.0.1]) by brutus.apache.org (Postfix) with ESMTP id 0C629234C14C for ; Tue, 1 Jul 2008 06:56:45 -0700 (PDT) Message-ID: <403877650.1214920605046.JavaMail.jira@brutus> Date: Tue, 1 Jul 2008 06:56:45 -0700 (PDT) From: "Dag H. Wanvik (JIRA)" To: derby-dev@db.apache.org Subject: [jira] Closed: (DERBY-3743) Revoking EXECUTE privilege on a function is not restricted if used in a CHECK constraint In-Reply-To: <1823970336.1214838824968.JavaMail.jira@brutus> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked by ClamAV on apache.org [ https://issues.apache.org/jira/browse/DERBY-3743?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Dag H. Wanvik closed DERBY-3743. -------------------------------- Resolution: Invalid Closing this, my repro was at error, sorry for the noise. > Revoking EXECUTE privilege on a function is not restricted if used in a CHECK constraint > ---------------------------------------------------------------------------------------- > > Key: DERBY-3743 > URL: https://issues.apache.org/jira/browse/DERBY-3743 > Project: Derby > Issue Type: Bug > Components: Security, SQL > Affects Versions: 10.5.0.0 > Reporter: Dag H. Wanvik > > The docs say that REVOKE EXECUTE ... RESTRICT should > fail if there is a dependent constraint: > "The RESTRICT clause specifies that the EXECUTE privilege cannot be > revoked if the specified routine is used in a view, trigger, or > constraint, and the privilege is being revoked from the owner of the > view, trigger, or constraint." > In this case the function f_abs is used in a CHECK > constraint. Revoking the privilege, however, is not restricted as > specified. > Running GrantRevokeDDLTest with the enclosed patch (revoke-bug.diff) > on trunk I see: > 1) testGrantRevokeDDL(org.apache.derbyTesting.functionTests.tests.lang.GrantRevokeDDLTest)java.sql.SQLSyntaxErrorException: User 'MAMTA3' does not have execute permission on FUNCTION 'MAMTA1'.'F_ABS'. > which shows that the revoke statement succeeded. > From inspecting the code, it seems that the dependency is not > registered in storeConstraintDependenciesOnPrivileges, which seems to > only care about REFERENCES privileges for constraints. -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online.