| 9851 | */ |
| 9852 | |
| 9853 | bool create_table_precheck(THD *thd, TABLE_LIST *tables, |
| 9854 | TABLE_LIST *create_table) |
| 9855 | { |
| 9856 | LEX *lex= thd->lex; |
| 9857 | SELECT_LEX *select_lex= lex->first_select_lex(); |
| 9858 | privilege_t want_priv{CREATE_ACL}; |
| 9859 | bool error= TRUE; // Error message is given |
| 9860 | DBUG_ENTER("create_table_precheck"); |
| 9861 | |
| 9862 | /* |
| 9863 | Require CREATE [TEMPORARY] privilege on new table; for |
| 9864 | CREATE TABLE ... SELECT, also require INSERT. |
| 9865 | */ |
| 9866 | |
| 9867 | if (lex->tmp_table()) |
| 9868 | want_priv= CREATE_TMP_ACL; |
| 9869 | else if (select_lex->item_list.elements || select_lex->tvc) |
| 9870 | want_priv|= INSERT_ACL; |
| 9871 | |
| 9872 | /* CREATE OR REPLACE on not temporary tables require DROP_ACL */ |
| 9873 | if (lex->create_info.or_replace() && !lex->tmp_table()) |
| 9874 | want_priv|= DROP_ACL; |
| 9875 | |
| 9876 | if (check_access(thd, want_priv, create_table->db.str, |
| 9877 | &create_table->grant.privilege, |
| 9878 | &create_table->grant.m_internal, |
| 9879 | 0, 0)) |
| 9880 | goto err; |
| 9881 | |
| 9882 | /* If it is a merge table, check privileges for merge children. */ |
| 9883 | if (lex->create_info.merge_list) |
| 9884 | { |
| 9885 | /* |
| 9886 | The user must have (SELECT_ACL | UPDATE_ACL | DELETE_ACL) on the |
| 9887 | underlying base tables, even if there are temporary tables with the same |
| 9888 | names. |
| 9889 | |
| 9890 | From user's point of view, it might look as if the user must have these |
| 9891 | privileges on temporary tables to create a merge table over them. This is |
| 9892 | one of two cases when a set of privileges is required for operations on |
| 9893 | temporary tables (see also CREATE TABLE). |
| 9894 | |
| 9895 | The reason for this behavior stems from the following facts: |
| 9896 | |
| 9897 | - For merge tables, the underlying table privileges are checked only |
| 9898 | at CREATE TABLE / ALTER TABLE time. |
| 9899 | |
| 9900 | In other words, once a merge table is created, the privileges of |
| 9901 | the underlying tables can be revoked, but the user will still have |
| 9902 | access to the merge table (provided that the user has privileges on |
| 9903 | the merge table itself). |
| 9904 | |
| 9905 | - Temporary tables shadow base tables. |
| 9906 | |
| 9907 | I.e. there might be temporary and base tables with the same name, and |
| 9908 | the temporary table takes the precedence in all operations. |
| 9909 | |
| 9910 | - For temporary MERGE tables we do not track if their child tables are |
no test coverage detected