commit 0b28d7e048fa097280be54f9baffd202f7626bdd

Author: Praveenkumar Hulakund <praveenkumar.hulakund@oracle.com>

Date:   Wed Sep 10 10:50:17 2014 +0530

    Bug#18790730 - CROSS-DATABASE FOREIGN KEY WITHOUT PERMISSIONS

                   CHECK.

    Analysis:

    ----------

    Issue here is, while creating or altering the InnoDB table,

    if the foreign key defined on the table references a parent

    table on which the user has no access privileges then the

    table is created without reporting any error.

    Currently the privilege level REFERENCES_ACL is unused

    and is not used for access evaluation while creating the

    table with a foreign key constraint or adding the foreign

    key constraint to a table. But when no privileges are granted

    to user then also access evaluation on parent table is ignored.

    Fix:

    ---------

    For DMLs, irrelevant of the fact, support does not want any

    changes to avoid permission checks on every operation.

    So, as a fix, added a function "check_fk_parent_table_access"

    to check whether any of the SELECT_ACL, INSERT_ACL, UDPATE_ACL,

    DELETE_ACL or REFERENCE_ACL privileges are granted for user

    at table level. If none of them is granted then error is reported.

    This function is called during the table creation and alter

    operation.

--source include/have_innodb.inc

DROP DATABASE test;

CREATE DATABASE kg_test1;

CREATE TABLE `kg_test1`.`group` (

  Id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY

) ENGINE=InnoDB DEFAULT CHARSET=utf8;

CREATE TABLE `kg_test1`.`person` (

`Id` INT(11) NOT NULL AUTO_INCREMENT,

`Name` VARCHAR(50) NOT NULL,

PRIMARY KEY (`Id`),

CONSTRAINT `fk_person_group` FOREIGN KEY (`Id`) REFERENCES `group` (`Id`)

) ENGINE=INNODB DEFAULT CHARSET=utf8;

SHOW WARNINGS;

DROP DATABASE kg_test1;

CREATE DATABASE test;