thevar1able/ClickHouse
1
0
Fork 0
mirror of https://github.com/ClickHouse/ClickHouse.git synced 2024-11-27 18:12:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

readonly user now can execute SHOW CREATE for access entities.

Browse Source
This commit is contained in:
Vitaly Baranov 2020-04-08 04:35:15 +03:00
parent c97d12a19c
commit 23ac1ee87c
4 changed files with 39 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/Access/ContextAccess.cpp
View File

@ -408,9 +408,10 @@ boost::shared_ptr<const AccessRights> ContextAccess::calculateResultAccess(bool
static const AccessFlags dictionary_ddl = AccessType::CREATE_DICTIONARY | AccessType::DROP_DICTIONARY; static const AccessFlags dictionary_ddl = AccessType::CREATE_DICTIONARY | AccessType::DROP_DICTIONARY;
static const AccessFlags table_and_dictionary_ddl = table_ddl | dictionary_ddl; static const AccessFlags table_and_dictionary_ddl = table_ddl | dictionary_ddl;
static const AccessFlags write_table_access = AccessType::INSERT | AccessType::OPTIMIZE; static const AccessFlags write_table_access = AccessType::INSERT | AccessType::OPTIMIZE;
static const AccessFlags write_dcl_access = AccessType::ACCESS_MANAGEMENT - AccessType::SHOW_ACCESS;
if (readonly_) if (readonly_)
merged_access->revoke(write_table_access | table_and_dictionary_ddl | AccessType::SYSTEM | AccessType::KILL_QUERY | AccessType::ACCESS_MANAGEMENT); merged_access->revoke(write_table_access | table_and_dictionary_ddl | write_dcl_access | AccessType::SYSTEM | AccessType::KILL_QUERY);
if (readonly_ == 1) if (readonly_ == 1)
{ {

0
tests/integration/test_enabling_access_management/__init__.py Normal file
View File

13
tests/integration/test_enabling_access_management/configs/users.d/extra_users.xml Normal file
View File

@ -0,0 +1,13 @@
<yandex>
<users>
<readonly>
<password></password>
<profile>readonly</profile>
<access_management>1</access_management>
</readonly>
<xyz>
<password></password>
<profile>default</profile>
</xyz>
</users>
</yandex>

24
tests/integration/test_enabling_access_management/test.py Normal file
View File

@ -0,0 +1,24 @@
import pytest
from helpers.cluster import ClickHouseCluster
cluster = ClickHouseCluster(__file__)
instance = cluster.add_instance('instance', config_dir="configs")
@pytest.fixture(scope="module", autouse=True)
def started_cluster():
try:
cluster.start()
yield cluster
finally:
cluster.shutdown()
def test_enabling_access_management():
instance.query("CREATE USER Alex", user='default')
assert instance.query("SHOW CREATE USER Alex", user='default') == "CREATE USER Alex\n"
assert instance.query("SHOW CREATE USER Alex", user='readonly') == "CREATE USER Alex\n"
assert "Not enough privileges" in instance.query_and_get_error("SHOW CREATE USER Alex", user='xyz')
assert "Cannot execute query in readonly mode" in instance.query_and_get_error("CREATE USER Robin", user='readonly')
assert "Not enough privileges" in instance.query_and_get_error("CREATE USER Robin", user='xyz')