Skip to content
/ server Public

MDEV-37948 ALTER TABLE TRUNCATE PARTITION requires only DROP privilege #4601

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
FarihaIS wants to merge 1 commit into
base: 12.2
Choose a base branch
from
+51 −1
Open

MDEV-37948 ALTER TABLE TRUNCATE PARTITION requires only DROP privilege #4601

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions mysql-test/main/partition_grant.result
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,29 @@ ERROR HY000: Table has no partition for value 1
disconnect conn5;
connection default;
drop table t1;
#
# MDEV-37948: ALTER TABLE ... TRUNCATE PARTITION should require ALTER privilege
#
create table t1 (a int) partition by list (a) (partition p1 values in (1), partition p2 values in (2), partition p3 values in (3));
insert into t1 values (1),(2),(3);
revoke all privileges on mysqltest_1.* from mysqltest_1@localhost;
grant drop on mysqltest_1.* to mysqltest_1@localhost;
connect conn6,localhost,mysqltest_1,,mysqltest_1;
show grants for current_user;
Grants for mysqltest_1@localhost
GRANT USAGE ON *.* TO `mysqltest_1`@`localhost`
GRANT DROP ON `mysqltest_1`.* TO `mysqltest_1`@`localhost`
alter table t1 truncate partition p1;
ERROR 42000: ALTER command denied to user 'mysqltest_1'@'localhost' for table `mysqltest_1`.`t1`
disconnect conn6;
connection default;
grant alter on mysqltest_1.* to mysqltest_1@localhost;
connect conn7,localhost,mysqltest_1,,mysqltest_1;
alter table t1 truncate partition p1;
disconnect conn7;
connection default;
revoke alter, drop on mysqltest_1.* from mysqltest_1@localhost;
drop table t1;
drop user mysqltest_1@localhost;
drop schema mysqltest_1;
End of 5.1 tests
27 changes: 27 additions & 0 deletions mysql-test/main/partition_grant.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,33 @@ disconnect conn5;
connection default;
drop table t1;

--echo #
--echo # MDEV-37948: ALTER TABLE ... TRUNCATE PARTITION should require ALTER privilege
--echo #

create table t1 (a int) partition by list (a) (partition p1 values in (1), partition p2 values in (2), partition p3 values in (3));
insert into t1 values (1),(2),(3);

revoke all privileges on mysqltest_1.* from mysqltest_1@localhost;
grant drop on mysqltest_1.* to mysqltest_1@localhost;

connect (conn6,localhost,mysqltest_1,,mysqltest_1);
show grants for current_user;
--error ER_TABLEACCESS_DENIED_ERROR
alter table t1 truncate partition p1;
disconnect conn6;

connection default;
grant alter on mysqltest_1.* to mysqltest_1@localhost;

connect (conn7,localhost,mysqltest_1,,mysqltest_1);
alter table t1 truncate partition p1;
disconnect conn7;

connection default;
revoke alter, drop on mysqltest_1.* from mysqltest_1@localhost;
drop table t1;

drop user mysqltest_1@localhost;
drop schema mysqltest_1;

Expand Down
2 changes: 1 addition & 1 deletion sql/sql_partition_admin.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -869,7 +869,7 @@ bool Sql_cmd_alter_table_truncate_partition::execute(THD *thd)
write the statement to the binary log if necessary.
*/

if (check_one_table_access(thd, DROP_ACL, first_table))
if (check_one_table_access(thd, DROP_ACL | ALTER_ACL, first_table))
Copy link
Contributor

@svoj svoj Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please keep as is for now, but having DROP_ACL here looks misleading to my eye. DROP_ACL refers to table object, not partition object. OTOH DROP_ACL on a database implies DROP_ACL on all tables in that database.

Looks like it comes from https://bugs.mysql.com/bug.php?id=17139, but I believe ALTER_ACL gives many options to spoil table data.

Copy link
Contributor Author

@FarihaIS FarihaIS Feb 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see, please let me know what changes you would like me to make here, if any. For now, I've left it as is like you suggested, thank you

Copy link
Contributor

@svoj svoj Feb 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is more a note to other reviewers. Something to consider, I have no strong opinion on this.

DBUG_RETURN(TRUE);

#ifdef WITH_WSREP
Expand Down