Skip to content
This repository was archived by the owner on Jan 28, 2021. It is now read-only.

Commit cb3b61c

Browse files
Make sure that DropView is not executed without write permissions
Signed-off-by: Alejandro García Montoro <alejandro.garciamontoro@gmail.com>
1 parent 38bf07f commit cb3b61c

File tree

2 files changed

+2
-1
lines changed

2 files changed

+2
-1
lines changed

engine.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ func (e *Engine) Query(
120120
case *plan.CreateIndex:
121121
typ = sql.CreateIndexProcess
122122
perm = auth.ReadPerm | auth.WritePerm
123-
case *plan.InsertInto, *plan.DeleteFrom, *plan.Update, *plan.DropIndex, *plan.UnlockTables, *plan.LockTables, *plan.CreateView:
123+
case *plan.InsertInto, *plan.DeleteFrom, *plan.Update, *plan.DropIndex, *plan.UnlockTables, *plan.LockTables, *plan.CreateView, *plan.DropView:
124124
perm = auth.ReadPerm | auth.WritePerm
125125
}
126126

engine_test.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3149,6 +3149,7 @@ func TestReadOnly(t *testing.T) {
31493149
`DROP INDEX foo ON mytable`,
31503150
`INSERT INTO mytable (i, s) VALUES(42, 'yolo')`,
31513151
`CREATE VIEW myview AS SELECT i FROM mytable`,
3152+
`DROP VIEW myview`,
31523153
}
31533154

31543155
for _, query := range writingQueries {

0 commit comments

Comments
 (0)