Bug #19789 VIEW with WITH CHECK OPTION allows invalid REPLACE
| Submitted: | 12 May 2006 22:41 | Modified: | 7 Jul 2006 20:25 |
|---|---|---|---|
| Reporter: | Paul Slezak | Email Updates: | |
| Status: | Closed | Impact on me: | |
| Category: | MySQL Server | Severity: | S2 (Serious) |
| Version: | 5.0.21 | OS: | Linux (Linux) |
| Assigned to: | Evgeny Potemkin | CPU Architecture: | Any |
[12 May 2006 22:41]
Paul Slezak
[12 May 2006 23:47]
Hartmut Holzgraefe
# MySQL Bugs #19789 # VIEW with WITH CHECK OPTION allows invalid REPLACE # http://bugs.mysql.com/19879 --disable_warnings DROP TABLE IF EXISTS t1; DROP VIEW IF EXISTS v1; --enable_warnings CREATE TABLE t1 (value INT PRIMARY KEY, filter INT); INSERT INTO t1 VALUES (1, 0); CREATE VIEW v1 AS SELECT value, filter FROM t1 WHERE filter = 0 WITH CHECK OPTION; --error 1369 INSERT INTO v1 (filter) VALUES (2); --error 1369 UPDATE v1 SET filter = 2; --error 1369 REPLACE INTO v1 (value, filter) VALUES (1, 2); DROP TABLE t1; DROP VIEW v1;
[13 May 2006 1:30]
Paul Slezak
I am not sure what the previous comment is supposed to mean unless the commands are being done on a later version of MySQL. Here is a verbatim cut/paste form the previous post with an added select
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 250 to server version: 5.0.21-standard
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
mysql> CREATE TABLE t1 (value INT PRIMARY KEY, filter INT);
Query OK, 0 rows affected (0.01 sec)
mysql> INSERT INTO t1 VALUES (1, 0);
Query OK, 1 row affected (0.01 sec)
mysql> CREATE VIEW v1 AS
-> SELECT value, filter FROM t1 WHERE filter = 0 WITH CHECK OPTION;
Query OK, 0 rows affected (0.00 sec)
mysql> INSERT INTO v1 (filter) VALUES (2);
ERROR 1369 (HY000): CHECK OPTION failed 'newco1.v1'
mysql> UPDATE v1 SET filter = 2;
ERROR 1369 (HY000): CHECK OPTION failed 'newco1.v1'
mysql> REPLACE INTO v1 (value, filter) VALUES (1, 2);
Query OK, 2 rows affected (0.00 sec)
mysql> select * from t1;
+-------+--------+
| value | filter |
+-------+--------+
| 1 | 2 |
+-------+--------+
1 row in set (0.01 sec)
For what it is worth, might as well note that 2 rows affected was returned, even though only one row exists.
[7 Jun 2006 12:44]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/7354
[19 Jun 2006 0:16]
Evgeny Potemkin
Fixed in 4.1.21, 5.0.23, 5.1.12
[19 Jun 2006 0:22]
Evgeny Potemkin
Sorry, fixed in 5.0 and 5.1 only
[20 Jun 2006 10:57]
Evgeny Potemkin
The st_lex::which_check_option_applicable() function controls for which statements WITH CHECK OPTION clause should be taken into account. REPLACE and REPLACE_SELECT wasn't in the list which results in allowing REPLACE to insert wrong rows in a such view.
[7 Jul 2006 20:25]
Mike Hillyer
Documented in 5.1.12 and 5.0.23 changelogs.
<listitem>
<para>
The <literal>WITH CHECK OPTION</literal> was not enforced when
a <literal>REPLACE</literal> statement was executed against a
view. (Bug #19789)
</para>
</listitem>
[28 Aug 2013 21:44]
Andrey Chirikba
As far as I can see, this is still present in 5.6.4, and I haven't seen any notes about it in further 5.6.x line releases. I think the previous testcase should do, but I can supply my own one if needed.
Portions of this website are copyright © 2001, 2002 The PHP Group
Page generated in 0.042 sec. using MySQL 8.4.7-u6-cloud
Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the
respective copyright holders.
It is not reviewed in advance
by Oracle and does not necessarily represent the opinion of
Oracle or any other party.