Issue Details (XML | Word | Printable)

Key: CORE-6078
Type: Bug Bug
Status: Closed Closed
Resolution: Fixed
Priority: Major Major
Assignee: Alexander Peshkov
Reporter: Simonov Denis
Votes: 0
Watchers: 6
Operations

If you were logged in you would be able to see more operations.
Firebird Core

Permissions for create or alter statements are not checked.

Created: 07/Jun/19 05:58 AM   Updated: 18/Jun/19 04:25 PM
Component/s: Security
Affects Version/s: 3.0.4
Fix Version/s: 3.0.5, 4.0 Beta 2

Environment: Firebird 3.0.5.33139 Windows x64

QA Status: Done successfully


 Description  « Hide
create test$user password '123'; -- Unprivileged user

-- connect to any database
set term ! ;
create procedure New_Procedure123
as
begin
end!
set term ; !
--This operation is not defined for system tables.
--unsuccessful metadata update.
--CREATE PROCEDURE NEW_PROCEDURE123 failed.
--There is no privilege for this operation.

set term ! ;
create or alter procedure New_Procedure123
as
begin
end!
set term ; !
--sucessfull???!

This applies to procedures, triggers, packages, functions, etc.

 All   Comments   Change History   Subversion Commits      Sort Order: Ascending order - Click to sort in descending order
Simonov Denis made changes - 07/Jun/19 05:59 AM
Field Original Value New Value
Description create test$user password '123'; -- Unprivileged user

-- connect to any database
set term ! ;
create procedure New_Procedure123
as
begin
end!
set term ; !
--This operation is not defined for system tables.
--unsuccessful metadata update.
--CREATE PROCEDURE NEW_PROCEDURE123 failed.
--There is no privilege for this operation.

set term ! ;
create or alter procedure New_Procedure123
as
begin
end!
set term ; !
--sucessfull???!
create test$user password '123'; -- Unprivileged user

-- connect to any database
set term ! ;
create procedure New_Procedure123
as
begin
end!
set term ; !
--This operation is not defined for system tables.
--unsuccessful metadata update.
--CREATE PROCEDURE NEW_PROCEDURE123 failed.
--There is no privilege for this operation.

set term ! ;
create or alter procedure New_Procedure123
as
begin
end!
set term ; !
--sucessfull???!

This applies to procedures, triggers, packages, functions, etc.
Alexander Peshkov made changes - 07/Jun/19 06:57 AM
Assignee Alexander Peshkov [ alexpeshkoff ]
Alexander Peshkov added a comment - 07/Jun/19 06:57 AM
Confirmed in FB4 too

Alexander Peshkov added a comment - 17/Jun/19 03:10 PM - edited
The following types of objects were fixed: exception, generator, package, procedure, function, view.

Alexander Peshkov made changes - 17/Jun/19 03:10 PM
Status Open [ 1 ] Resolved [ 5 ]
Fix Version/s 3.0.5 [ 10885 ]
Fix Version/s 4.0 Beta 2 [ 10888 ]
Resolution Fixed [ 1 ]
Pavel Zotov made changes - 18/Jun/19 04:25 PM
Status Resolved [ 5 ] Resolved [ 5 ]
QA Status No test Done successfully
Pavel Zotov made changes - 18/Jun/19 04:25 PM
Status Resolved [ 5 ] Closed [ 6 ]