Check that we have enough rights to access all resources this list of triggers touches.
| 735 | |
| 736 | // Check that we have enough rights to access all resources this list of triggers touches. |
| 737 | void Statement::verifyTriggerAccess(thread_db* tdbb, jrd_rel* ownerRelation, |
| 738 | TrigVector* triggers, MetaName userName) |
| 739 | { |
| 740 | if (!triggers) |
| 741 | return; |
| 742 | |
| 743 | SET_TDBB(tdbb); |
| 744 | |
| 745 | for (FB_SIZE_T i = 0; i < triggers->getCount(); i++) |
| 746 | { |
| 747 | Trigger& t = (*triggers)[i]; |
| 748 | t.compile(tdbb); |
| 749 | if (!t.statement) |
| 750 | continue; |
| 751 | |
| 752 | for (const AccessItem* access = t.statement->accessList.begin(); |
| 753 | access != t.statement->accessList.end(); ++access) |
| 754 | { |
| 755 | // If this is not a system relation, we don't post access check if: |
| 756 | // |
| 757 | // - The table being checked is the owner of the trigger that's accessing it. |
| 758 | // - The field being checked is owned by the same table than the trigger |
| 759 | // that's accessing the field. |
| 760 | // - Since the trigger name comes in the triggers vector of the table and each |
| 761 | // trigger can be owned by only one table for now, we know for sure that |
| 762 | // it's a trigger defined on our target table. |
| 763 | |
| 764 | if (!(ownerRelation->rel_flags & REL_system)) |
| 765 | { |
| 766 | if (access->acc_type == obj_relations && |
| 767 | (ownerRelation->rel_name == access->acc_name)) |
| 768 | { |
| 769 | continue; |
| 770 | } |
| 771 | if (access->acc_type == obj_column && |
| 772 | (ownerRelation->rel_name == access->acc_r_name)) |
| 773 | { |
| 774 | continue; |
| 775 | } |
| 776 | } |
| 777 | |
| 778 | // a direct access to an object from this trigger |
| 779 | if (access->acc_ss_rel_id) |
| 780 | { |
| 781 | const jrd_rel* view = MET_lookup_relation_id(tdbb, access->acc_ss_rel_id, false); |
| 782 | if (view && (view->rel_flags & REL_sql_relation)) |
| 783 | userName = view->rel_owner_name; |
| 784 | } |
| 785 | else if (t.ssDefiner.specified && t.ssDefiner.value) |
| 786 | userName = t.owner; |
| 787 | |
| 788 | Attachment* attachment = tdbb->getAttachment(); |
| 789 | UserId* effectiveUser = userName.hasData() ? attachment->getUserId(userName) : attachment->att_ss_user; |
| 790 | AutoSetRestore<UserId*> userIdHolder(&attachment->att_ss_user, effectiveUser); |
| 791 | |
| 792 | const SecurityClass* sec_class = SCL_get_class(tdbb, access->acc_security_name.c_str()); |
| 793 | |
| 794 | SCL_check_access(tdbb, sec_class, id_trigger, t.statement->triggerName, access->acc_mask, |