db-derby-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Mamta A. Satoor (JIRA)" <j...@apache.org>
Subject [jira] Commented: (DERBY-4191) Lack of SELECT privilege does not prevent SELECT COUNT(*)
Date Fri, 11 Dec 2009 17:35:18 GMT

    [ https://issues.apache.org/jira/browse/DERBY-4191?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12789412#action_12789412

Mamta A. Satoor commented on DERBY-4191:

Rick, thanks for reviewing the patch. It appears that my logic of determining whether we are
inside UPDATE/DELETE etc statement is not as full-proof as I thought. I will look further
into it. 

As for the permission available through role rather than direct direct tests, I will attempt
to add a standalong test fixture in RolesConferredPrivilegesTest.java The existing test fixtures
are very sophisticated for what I need to test. If anyone has ideas on how I can use the existing
test fixture in RolesConferredPrivilegesTest.java to add a test case like
select t1.c1 from user1.t1, user1.t2
Otherwise, I will just add a new test fixture to test above.

> Lack of SELECT privilege does not prevent SELECT COUNT(*)
> ---------------------------------------------------------
>                 Key: DERBY-4191
>                 URL: https://issues.apache.org/jira/browse/DERBY-4191
>             Project: Derby
>          Issue Type: Bug
>          Components: SQL
>    Affects Versions:,
>            Reporter: Knut Anders Hatlen
>            Assignee: Mamta A. Satoor
>         Attachments: DERBY4191_ColumnLevelCheckInStatmentColumnPerm_diff_patch2.txt,
DERBY4191_ColumnLevelCheckInStatmentColumnPerm_stat_patch2.txt, DERBY4191_ColumnLevelCheckInStatmentTablePerm_diff_patch1.txt,
DERBY4191_countStar_privilege_diff_patch1.txt, DERBY4191_miniumSelectPrivOnAllTables_diff_patch3.txt,
DERBY4191_miniumSelectPrivOnAllTables_stat_patch3.txt, repro.sql
> A user that does not have SELECT privilege on a table can still perform a SELECT COUNT(*)
on that table. Counting a specific column (e.g., SELECT COUNT(X)) is prevented.

This message is automatically generated by JIRA.
You can reply to this email to add a comment to the issue online.

View raw message