[MDEV-23085] INSERT .. RETURNING requires INSERT privilege on columns which only participate in RETURNING clause Created: 2020-07-03  Updated: 2020-07-03

Status: Open
Project: MariaDB Server
Component/s: Authentication and Privilege System, Data Manipulation - Insert
Affects Version/s: 10.5
Fix Version/s: 10.5

Type: Bug Priority: Minor
Reporter: Elena Stepanova Assignee: Sergei Golubchik
Resolution: Unresolved Votes: 0
Labels: None


 Description   

create database db;
create table db.t (a int, b int);
create user foo;
grant insert (a) on db.t to foo;
grant select (b) on db.t to foo;
 
--connect (con1,localhost,foo,,)
insert into db.t (a) values (1) returning b;
 
# Cleanup
--disconnect con1
--connection default
drop database db;
drop user foo;

10.5 6cee9b1953

MariaDB [test]> insert into db.t (a) values (1) returning b;
ERROR 1143 (42000): INSERT command denied to user 'foo'@'localhost' for column 'b' in table 't'

Without RETURNING, the same INSERT works, so the INSERT privilege isn't really needed:

MariaDB [test]> insert into db.t (a) values (1);
Query OK, 1 row affected (0.017 sec)


Generated at Thu Feb 08 09:19:44 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.