Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(query): list user stage not check privilege #15800

Merged
merged 3 commits into from
Jun 15, 2024
Merged

fix(query): list user stage not check privilege #15800

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3a17971
fix(query): list user stage not check privilege
TCeason Jun 14, 2024
fc0b1a2
fix clippy
TCeason Jun 14, 2024
3ccce37
Merge branch 'main' into list_stage
TCeason Jun 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/query/service/src/table_functions/infer_schema/parquet.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ use databend_common_expression::DataBlock;
use databend_common_expression::FromData;
use databend_common_expression::TableSchema;
use databend_common_meta_app::principal::StageFileFormatType;
use databend_common_meta_app::principal::StageType;
use databend_common_pipeline_core::processors::OutputPort;
use databend_common_pipeline_core::processors::ProcessorPtr;
use databend_common_pipeline_sources::AsyncSource;
Expand Down Expand Up @@ -108,6 +109,8 @@ impl AsyncSource for ParquetInferSchemaSource {
let visibility_checker = self.ctx.get_visibility_checker().await?;
if !stage_info.is_temporary
&& !visibility_checker.check_stage_read_visibility(&stage_info.stage_name)
&& !(stage_info.stage_type == StageType::User
&& stage_info.stage_name == self.ctx.get_current_user()?.name)
{
return Err(ErrorCode::PermissionDenied(format!(
"Permission denied: privilege READ is required on stage {} for user {}",
Expand Down
3 changes: 3 additions & 0 deletions src/query/service/src/table_functions/inspect_parquet/inspect_parquet_table.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ use databend_common_expression::TableField;
use databend_common_expression::TableSchema;
use databend_common_expression::TableSchemaRefExt;
use databend_common_expression::Value;
use databend_common_meta_app::principal::StageType;
use databend_common_meta_app::schema::TableIdent;
use databend_common_meta_app::schema::TableInfo;
use databend_common_meta_app::schema::TableMeta;
Expand Down Expand Up @@ -216,6 +217,8 @@ impl AsyncSource for InspectParquetSource {
let visibility_checker = self.ctx.get_visibility_checker().await?;
if !stage_info.is_temporary
&& !visibility_checker.check_stage_read_visibility(&stage_info.stage_name)
&& !(stage_info.stage_type == StageType::User
&& stage_info.stage_name == self.ctx.get_current_user()?.name)
{
return Err(ErrorCode::PermissionDenied(format!(
"Permission denied: privilege READ is required on stage {} for user {}",
Expand Down
3 changes: 3 additions & 0 deletions src/query/service/src/table_functions/list_stage/list_stage_table.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ use databend_common_expression::TableDataType;
use databend_common_expression::TableField;
use databend_common_expression::TableSchema;
use databend_common_expression::TableSchemaRefExt;
use databend_common_meta_app::principal::StageType;
use databend_common_meta_app::schema::TableIdent;
use databend_common_meta_app::schema::TableInfo;
use databend_common_meta_app::schema::TableMeta;
Expand Down Expand Up @@ -189,6 +190,8 @@ impl ListStagesSource {
let visibility_checker = self.ctx.get_visibility_checker().await?;
if !stage_info.is_temporary
&& !visibility_checker.check_stage_read_visibility(&stage_info.stage_name)
&& !(stage_info.stage_type == StageType::User
&& stage_info.stage_name == self.ctx.get_current_user()?.name)
{
return Err(ErrorCode::PermissionDenied(format!(
"Permission denied: privilege READ is required on stage {} for user {}",
Expand Down
2 changes: 2 additions & 0 deletions tests/suites/0_stateless/18_rbac/18_0007_privilege_access.result
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@ Error: APIError: ResponseError with 1025: Unknown table 'tbnotexists'
>>>> GRANT SELECT ON dbnotexists.* TO 'test-user'
Error: APIError: ResponseError with 1003: Unknown database 'dbnotexists'
<<<<
=== check list user's local stage ===
=== no err ===
information_schema
system
test -- insert
Expand Down
4 changes: 4 additions & 0 deletions tests/suites/0_stateless/18_rbac/18_0007_privilege_access.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,10 @@ echo 'create role `test-role2`' | $BENDSQL_CLIENT_CONNECT
echo "drop table if exists t20_0012" | $BENDSQL_CLIENT_CONNECT
echo "create table t20_0012(c int not null)" | $BENDSQL_CLIENT_CONNECT

echo "=== check list user's local stage ==="
echo "list @~" | $TEST_USER_CONNECT
echo "=== no err ==="

## show tables
echo "show databases" | $TEST_USER_CONNECT

Expand Down
Loading