~percona-core/percona-server/upstream-5.0 : changes

~percona-core/percona-server/upstream-5.0 » Changes from revision 2928

From Revision 2928 to 2909

Rev	Summary	Authors	Tags	Date
2928	merge merge	Mattias Jonsson	clone-5.0.95-build, mysql-5.0.95	12 years ago
2927	Bug#12563865 ROUNDED,TMP_BUF,DECIMAL_VALUE STACK CORRUPTION ... Bug#12563865 ROUNDED,TMP_BUF,DECIMAL_VALUE STACK CORRUPTION IN ALL VERSIONS >=5.0 Buffer over-run on all platforms, crash on windows, wrong result on other platforms, when rounding numbers which start with 999999999 and have precision = 9 or 18 or 27 or 36 ...	Tor Didriksen		12 years ago
2926	auto-merge mysql-5.0->mysql-5.0-security auto-merge mysql-5.0->mysql-5.0-security	Georgi Kodinov		12 years ago
2925	additional clean-up for 11765687 additional clean-up for 11765687	Tatjana Azundris Nue...		12 years ago
2924	Bug#11765687 (MySQL58677): No privilege on table / view, but... Bug#11765687 (MySQL58677): No privilege on table / view, but can know #rows / underlying table's name 1 - If a user had SHOW VIEW and SELECT privileges on a view and this view was referencing another view, EXPLAIN SELECT on the outer view (that the user had privileges on) could reveal the structure of the underlying "inner" view as well as the number of rows in the underlying tables, even if the user had privileges on none of these referenced objects. This happened because we used DEFINER's UID ("SUID") not just for the view given in EXPLAIN, but also when checking privileges on the underlying views (where we should use the UID of the EXPLAIN's INVOKER instead). We no longer run the EXPLAIN SUID (with DEFINER's privileges). This prevents a possible exploit and makes permissions more orthogonal. 2 - EXPLAIN SELECT would reveal a view's structure even if the user did not have SHOW VIEW privileges for that view, as long as they had SELECT privilege on the underlying tables. Instead of requiring both SHOW VIEW privilege on a view and SELECT privilege on all underlying tables, we were checking for presence of either of them. We now explicitly require SHOW VIEW and SELECT privileges on the view we run EXPLAIN SELECT on, as well as all its underlying views. We also require SELECT on all relevant tables.	Tatjana Azundris Nue...		12 years ago
2923	changed the old @sun.com address of security trees. changed the old @sun.com address of security trees.	Georgi Kodinov		12 years ago
2922	Bug#12406055 post-push fix: ignore float output Bug#12406055 post-push fix: ignore float output	Tor Didriksen		12 years ago
2921	Bug#12406055 BUFFER OVERFLOW OF VARIABLE 'BUFF' IN STRING::S... Bug#12406055 BUFFER OVERFLOW OF VARIABLE 'BUFF' IN STRING::SET_REAL The buffer was simply too small. In 5.5 and trunk, the size is 311 + 31, in 5.1 and below, the size is 331	Tor Didriksen		12 years ago
2920	weave merge of mysql-5.0->mysql-5.0-security weave merge of mysql-5.0->mysql-5.0-security	Georgi Kodinov		12 years ago
2919	auto-merge of version update from mysql-5.0 to mysql-5.0-sec... auto-merge of version update from mysql-5.0 to mysql-5.0-security	Georgi Kodinov		12 years ago
2918	Raise version number after cloning 5.0.94 Raise version number after cloning 5.0.94	Sunanda Menon		12 years ago
2917	weave merge of 5.0->5.0-security weave merge of 5.0->5.0-security	Georgi Kodinov	clone-5.0.94-build, mysql-5.0.94	12 years ago
2916	Addendum 3 for bug #BUG#11764517 : expand secure_file_priv t... Addendum 3 for bug #BUG#11764517 : expand secure_file_priv to the real patch so that it can later be compared with patchs with expanded symlinks	Georgi Kodinov		12 years ago
2915	Addendum to bug #11764517 : don't create links for --mem dir... Addendum to bug #11764517 : don't create links for --mem directory, move the --vardir instead. The new --secure-file-priv checks dereference any symlinks in the paths and compare the resolved paths. Thus the 5.0 test suite must do as the 5.1 and up and avoid using symlinks.	Georgi Kodinov		12 years ago
2914	Bug#12329653 - EXPLAIN, UNION, PREPARED STATEMENT, CRASH, SQ... Bug#12329653 - EXPLAIN, UNION, PREPARED STATEMENT, CRASH, SQL_FULL_GROUP_BY The query was re-written after we had tagged it with NON_AGG_FIELD_USED. Remove the flag before continuing.	Tor Didriksen		12 years ago
2913	Addendum to the fix for bug #11764517 : replaced an absolute... Addendum to the fix for bug #11764517 : replaced an absolute path.	Georgi Kodinov		12 years ago
2912	Bug #11764517: 57359: POSSIBLE TO CIRCUMVENT SECURE_FILE_PRI... Bug #11764517: 57359: POSSIBLE TO CIRCUMVENT SECURE_FILE_PRIV USING '..' ON WINDOWS Backport of the fix to 5.0 (to be null-merged to 5.1). Moved the test into the main test suite. Made mysql-test-run.pl to not use symlinks for sdtdata as the symlinks are now properly recognized by secure_file_priv. Made sure the paths in load_file(), LOAD DATA and SELECT .. INTO OUTFILE that are checked against secure_file_priv in a correct way similarly to 5.1 by the extended is_secure_file_path() backport before the comparison. Added an extensive test with all the variants of upper/lower case, slash/backslash and case sensitivity. Added few comments to the code.	Georgi Kodinov		12 years ago
2911	Bug #11810224: CORRECT INVALID LGPL NOTICE IN CLUSTER FILES Bug #11810224: CORRECT INVALID LGPL NOTICE IN CLUSTER FILES The 5.0 fix. Removed unreferenced files and the directory that has them.	Georgi Kodinov		13 years ago
2910	Bug#11882603 SELECT_ACL ON ANY COLUMN IN MYSQL.PROC ALLOWS T... Bug#11882603 SELECT_ACL ON ANY COLUMN IN MYSQL.PROC ALLOWS TO SEE DEFINITION OF ANY ROUTINE. This follow-up patch removes SHOW PROCEDURE CODE from the test case as this command is only available on debug versions of the server and therefore caused the test to fail on release builds.	Jon Olav Hauglid		13 years ago
2909	Bug#11882603 SELECT_ACL ON ANY COLUMN IN MYSQL.PROC ALLOWS T... Bug#11882603 SELECT_ACL ON ANY COLUMN IN MYSQL.PROC ALLOWS TO SEE DEFINITION OF ANY ROUTINE. The problem was that having the SELECT privilege any column of the mysql.proc table by mistake allowed the user to see the definition of all routines (using SHOW CREATE PROCEDURE/FUNCTION and SHOW PROCEDURE/FUNCTION CODE). This patch fixes the problem by making sure that those commands are only allowed if the user has the SELECT privilege on the mysql.proc table itself. Test case added to sp-security.test.	Jon Olav Hauglid		13 years ago

Older »