Commit 7730b46b authored by unknown's avatar unknown

Merge stella.local:/home2/mydev/mysql-5.0-ateam

into  stella.local:/home2/mydev/mysql-5.0-axmrg

parents 47e43632 c63fd4dd
Branches unavailable
Tags unavailable
No related merge requests found
...@@ -99,6 +99,12 @@ t1 CREATE TABLE `t1` ( ...@@ -99,6 +99,12 @@ t1 CREATE TABLE `t1` (
`b` int(11) default NULL `b` int(11) default NULL
) ENGINE=MyISAM DEFAULT CHARSET=latin1 ) ENGINE=MyISAM DEFAULT CHARSET=latin1
drop table t1; drop table t1;
CREATE TABLE t1(a INT)
DATA DIRECTORY='TEST_DIR/var/master-data/mysql'
INDEX DIRECTORY='TEST_DIR/var/master-data/mysql';
RENAME TABLE t1 TO user;
ERROR HY000: Can't create/write to file 'TEST_DIR/var/master-data/mysql/user.MYI' (Errcode: 17)
DROP TABLE t1;
show create table t1; show create table t1;
Table Create Table Table Create Table
t1 CREATE TABLE `t1` ( t1 CREATE TABLE `t1` (
......
...@@ -124,6 +124,18 @@ enable_query_log; ...@@ -124,6 +124,18 @@ enable_query_log;
show create table t1; show create table t1;
drop table t1; drop table t1;
#
# BUG#32111 - Security Breach via DATA/INDEX DIRECORY and RENAME TABLE
#
--replace_result $MYSQL_TEST_DIR TEST_DIR
eval CREATE TABLE t1(a INT)
DATA DIRECTORY='$MYSQL_TEST_DIR/var/master-data/mysql'
INDEX DIRECTORY='$MYSQL_TEST_DIR/var/master-data/mysql';
--replace_result $MYSQL_TEST_DIR TEST_DIR
--error 1
RENAME TABLE t1 TO user;
DROP TABLE t1;
# #
# Test specifying DATA DIRECTORY that is the same as what would normally # Test specifying DATA DIRECTORY that is the same as what would normally
# have been chosen. (Bug #8707) # have been chosen. (Bug #8707)
......
...@@ -126,6 +126,7 @@ int my_rename_with_symlink(const char *from, const char *to, myf MyFlags) ...@@ -126,6 +126,7 @@ int my_rename_with_symlink(const char *from, const char *to, myf MyFlags)
int was_symlink= (!my_disable_symlinks && int was_symlink= (!my_disable_symlinks &&
!my_readlink(link_name, from, MYF(0))); !my_readlink(link_name, from, MYF(0)));
int result=0; int result=0;
int name_is_different;
DBUG_ENTER("my_rename_with_symlink"); DBUG_ENTER("my_rename_with_symlink");
if (!was_symlink) if (!was_symlink)
...@@ -134,6 +135,14 @@ int my_rename_with_symlink(const char *from, const char *to, myf MyFlags) ...@@ -134,6 +135,14 @@ int my_rename_with_symlink(const char *from, const char *to, myf MyFlags)
/* Change filename that symlink pointed to */ /* Change filename that symlink pointed to */
strmov(tmp_name, to); strmov(tmp_name, to);
fn_same(tmp_name,link_name,1); /* Copy dir */ fn_same(tmp_name,link_name,1); /* Copy dir */
name_is_different= strcmp(link_name, tmp_name);
if (name_is_different && !access(tmp_name, F_OK))
{
my_errno= EEXIST;
if (MyFlags & MY_WME)
my_error(EE_CANTCREATEFILE, MYF(0), tmp_name, EEXIST);
DBUG_RETURN(1);
}
/* Create new symlink */ /* Create new symlink */
if (my_symlink(tmp_name, to, MyFlags)) if (my_symlink(tmp_name, to, MyFlags))
...@@ -145,7 +154,7 @@ int my_rename_with_symlink(const char *from, const char *to, myf MyFlags) ...@@ -145,7 +154,7 @@ int my_rename_with_symlink(const char *from, const char *to, myf MyFlags)
the same basename and different directories. the same basename and different directories.
*/ */
if (strcmp(link_name, tmp_name) && my_rename(link_name, tmp_name, MyFlags)) if (name_is_different && my_rename(link_name, tmp_name, MyFlags))
{ {
int save_errno=my_errno; int save_errno=my_errno;
my_delete(to, MyFlags); /* Remove created symlink */ my_delete(to, MyFlags); /* Remove created symlink */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment