[jira] [Work started] (TRAFODION-1594) Select from table returns data even though user has no privs

["Roberta Marton (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/TRAFODION-1594?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Work on TRAFODION-1594 started by Roberta Marton.
-------------------------------------------------
> Select from table returns data even though user has no privs
> ------------------------------------------------------------
>
>                 Key: TRAFODION-1594
>                 URL: https://issues.apache.org/jira/browse/TRAFODION-1594
>             Project: Apache Trafodion
>          Issue Type: Bug
>          Components: sql-security
>            Reporter: Roberta Marton
>            Assignee: Roberta Marton
>
> A user was able to select data from a table where the user had no privs.
> case:
> DB__ROOT created a schema on behalf of sql_user1.
> The following tables were created in this schema - games, teams, and players.
> sql_user1 granted select privilege to sql_user7 on table games.
> sql_user7 was able to select from both games and teams.  sql_user7 was not able to select from players.
> Looking at the metadata indicated that sql_user7 indeed did not have privileges an table teams. 
> When sql_user7 reconnected, they were not able to select from teams.
> The thought is that perhaps there was some stale cache in mxorsrv



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)