Bugzilla – Attachment 74510 Details for
Bug 16690
Improve security of remote database installations
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 16690: Simplify and correct the SHOW GRANTS
Bug-16690-Simplify-and-correct-the-SHOW-GRANTS.patch (text/plain), 3.09 KB, created by
Mark Tompsett
on 2018-04-19 01:05:12 UTC
(
hide
)
Description:
Bug 16690: Simplify and correct the SHOW GRANTS
Filename:
MIME Type:
Creator:
Mark Tompsett
Created:
2018-04-19 01:05:12 UTC
Size:
3.09 KB
patch
obsolete
>From 69b3e27ee0c2f3bc436a0fa09e60df0325469ec9 Mon Sep 17 00:00:00 2001 >From: Mark Tompsett <mtompset@hotmail.com> >Date: Thu, 19 Apr 2018 01:00:20 +0000 >Subject: [PATCH] Bug 16690: Simplify and correct the SHOW GRANTS > >MySQL / MariaDB allow the current connected user to >check their own grants with CURRENT_USER. >There is no need for the installer to know the >IP address of the webserver. >--- > installer/install.pl | 31 +++++-------------------------- > 1 file changed, 5 insertions(+), 26 deletions(-) > >diff --git a/installer/install.pl b/installer/install.pl >index 0cdbca3..b1c3d6e 100755 >--- a/installer/install.pl >+++ b/installer/install.pl >@@ -63,7 +63,6 @@ $info{'dbms'} = ( > : "mysql" > ); > $info{'hostname'} = C4::Context->config("hostname"); >-$info{'webserver'} = C4::Context->config("webserver"); > $info{'port'} = C4::Context->config("port"); > $info{'user'} = C4::Context->config("user"); > $info{'password'} = C4::Context->config("pass"); >@@ -146,10 +145,11 @@ elsif ( $step && $step == 2 ) { > $template->param( 'checkdatabasecreated' => 1 ); > } > >- #Check if user have all necessary grants on this database. >- my $rq = >- $dbh->prepare( >- "SHOW GRANTS FOR \'$info{user}\'\@'$info{webserver}'"); >+ # Check if user have all necessary grants on this database. >+ # CURRENT_USER is ANSI SQL, and doesn't require mysql table >+ # privileges, making the % check pointless, since they >+ # couldn't even check GRANTS if they couldn't connect. >+ my $rq = $dbh->prepare('SHOW GRANTS FOR CURRENT_USER'); > $rq->execute; > my $grantaccess; > while ( my ($line) = $rq->fetchrow ) { >@@ -169,27 +169,6 @@ elsif ( $step && $step == 2 ) { > ); > } > } >- unless ($grantaccess) { >- $rq = >- $dbh->prepare("SHOW GRANTS FOR \'$info{user}\'\@'\%'"); >- $rq->execute; >- while ( my ($line) = $rq->fetchrow ) { >- my $dbname = $info{dbname}; >- if ( $line =~ m/$dbname/ || index( $line, '*.*' ) > 0 ) >- { >- $grantaccess = 1 >- if ( >- index( $line, 'ALL PRIVILEGES' ) > 0 >- || ( ( index( $line, 'SELECT' ) > 0 ) >- && ( index( $line, 'INSERT' ) > 0 ) >- && ( index( $line, 'UPDATE' ) > 0 ) >- && ( index( $line, 'DELETE' ) > 0 ) >- && ( index( $line, 'CREATE' ) > 0 ) >- && ( index( $line, 'DROP' ) > 0 ) ) >- ); >- } >- } >- } > $template->param( "checkgrantaccess" => $grantaccess ); > } # End mysql connect check... > >-- >2.1.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 16690
:
52174
|
53162
|
64847
|
64848
|
74510
|
74511
|
74849
|
79325
|
79662