From 7002c4237e7bcc9c95941c202de6c36cb60192af Mon Sep 17 00:00:00 2001 From: zhangdong <493738387@qq.com> Date: Wed, 21 Aug 2024 16:15:43 +0800 Subject: [PATCH 1/3] 1 --- .../org/apache/doris/analysis/ShowColumnStmt.java | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowColumnStmt.java b/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowColumnStmt.java index eb7fcaf0285e6a..9af269104cc993 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowColumnStmt.java +++ b/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowColumnStmt.java @@ -18,9 +18,14 @@ package org.apache.doris.analysis; import org.apache.doris.catalog.Column; +import org.apache.doris.catalog.Env; import org.apache.doris.catalog.InfoSchemaDb; import org.apache.doris.catalog.ScalarType; import org.apache.doris.common.AnalysisException; +import org.apache.doris.common.ErrorCode; +import org.apache.doris.common.ErrorReport; +import org.apache.doris.mysql.privilege.PrivPredicate; +import org.apache.doris.qe.ConnectContext; import org.apache.doris.qe.ShowResultSetMetaData; import com.google.common.base.Strings; @@ -103,6 +108,12 @@ public void analyze(Analyzer analyzer) throws AnalysisException { } else { metaData = META_DATA; } + if (!Env.getCurrentEnv().getAccessManager() + .checkTblPriv(ConnectContext.get(), tableName.getCtl(), tableName.getDb(), + tableName.getTbl(), PrivPredicate.SHOW)) { + ErrorReport.reportAnalysisException(ErrorCode.ERR_TABLE_ACCESS_DENIED_ERROR, + PrivPredicate.SHOW.getPrivs().toString(), tableName); + } } @Override From 3bf98392d80cbfc1ca683f6cf60a8a0c5a6191a4 Mon Sep 17 00:00:00 2001 From: zhangdong <493738387@qq.com> Date: Wed, 21 Aug 2024 16:29:11 +0800 Subject: [PATCH 2/3] 1 --- .../src/main/java/org/apache/doris/analysis/ShowDataStmt.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowDataStmt.java b/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowDataStmt.java index c8d37a4b33da96..84ce67283ac487 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowDataStmt.java +++ b/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowDataStmt.java @@ -127,7 +127,7 @@ public void analyze(Analyzer analyzer) throws UserException { return; } dbName = analyzer.getDefaultDb(); - if (Strings.isNullOrEmpty(dbName)) { + if (Strings.isNullOrEmpty(dbName) && tableName == null) { getAllDbStats(); return; } From 3cfa635fd8622130903cb5d4c475040ff7e35b0b Mon Sep 17 00:00:00 2001 From: zhangdong <493738387@qq.com> Date: Wed, 21 Aug 2024 17:46:05 +0800 Subject: [PATCH 3/3] 1 --- .../java/org/apache/doris/analysis/ShowSyncJobStmt.java | 9 +++++++++ .../doris/analysis/ShowTabletStorageFormatStmt.java | 6 ++---- .../main/java/org/apache/doris/qe/ConnectScheduler.java | 2 +- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowSyncJobStmt.java b/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowSyncJobStmt.java index 25980ea16a8c53..f0671f8afe0619 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowSyncJobStmt.java +++ b/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowSyncJobStmt.java @@ -18,10 +18,14 @@ package org.apache.doris.analysis; import org.apache.doris.catalog.Column; +import org.apache.doris.catalog.Env; import org.apache.doris.catalog.ScalarType; import org.apache.doris.common.ErrorCode; import org.apache.doris.common.ErrorReport; import org.apache.doris.common.UserException; +import org.apache.doris.datasource.InternalCatalog; +import org.apache.doris.mysql.privilege.PrivPredicate; +import org.apache.doris.qe.ConnectContext; import org.apache.doris.qe.ShowResultSetMetaData; import com.google.common.base.Strings; @@ -60,6 +64,11 @@ public void analyze(Analyzer analyzer) throws UserException { ErrorReport.reportAnalysisException(ErrorCode.ERR_NO_DB_ERROR); } } + if (!Env.getCurrentEnv().getAccessManager() + .checkDbPriv(ConnectContext.get(), InternalCatalog.INTERNAL_CATALOG_NAME, dbName, PrivPredicate.SHOW)) { + ErrorReport.reportAnalysisException(ErrorCode.ERR_DB_ACCESS_DENIED_ERROR, + PrivPredicate.SHOW.getPrivs().toString(), dbName); + } } @Override diff --git a/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowTabletStorageFormatStmt.java b/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowTabletStorageFormatStmt.java index 441f0f1d7d5288..9d0f3b88e6c3b2 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowTabletStorageFormatStmt.java +++ b/fe/fe-core/src/main/java/org/apache/doris/analysis/ShowTabletStorageFormatStmt.java @@ -38,10 +38,8 @@ public ShowTabletStorageFormatStmt(boolean verbose) { public void analyze(Analyzer analyzer) throws UserException { // check access first if (!Env.getCurrentEnv().getAccessManager().checkGlobalPriv(ConnectContext.get(), PrivPredicate.ADMIN)) { - ErrorReport.reportAnalysisException(ErrorCode.ERR_ACCESS_DENIED_ERROR, - toSql(), - ConnectContext.get().getQualifiedUser(), - ConnectContext.get().getRemoteIP(), "ADMIN Privilege needed."); + ErrorReport.reportAnalysisException(ErrorCode.ERR_SPECIFIC_ACCESS_DENIED_ERROR, + PrivPredicate.ADMIN.getPrivs().toString()); } super.analyze(analyzer); diff --git a/fe/fe-core/src/main/java/org/apache/doris/qe/ConnectScheduler.java b/fe/fe-core/src/main/java/org/apache/doris/qe/ConnectScheduler.java index 97d47340194107..058642112450c2 100644 --- a/fe/fe-core/src/main/java/org/apache/doris/qe/ConnectScheduler.java +++ b/fe/fe-core/src/main/java/org/apache/doris/qe/ConnectScheduler.java @@ -163,7 +163,7 @@ public List listConnection(String user, boolean isFul for (ConnectContext ctx : connectionMap.values()) { // Check auth if (!ctx.getQualifiedUser().equals(user) && !Env.getCurrentEnv().getAccessManager() - .checkGlobalPriv(ConnectContext.get(), PrivPredicate.GRANT)) { + .checkGlobalPriv(ConnectContext.get(), PrivPredicate.ADMIN)) { continue; }