if (hasPermissionOnTable(lcc, activation,
authorizationId, forGrant, ps)) {
return;
}
FormatableBitSet permittedColumns = null;
if( ! forGrant)
{
permittedColumns = addPermittedColumns( dd,
false /* non-grantable permissions */,
Authorizer.PUBLIC_AUTHORIZATION_ID,
permittedColumns);
permittedColumns = addPermittedColumns( dd,
false /* non-grantable permissions */,
authorizationId,
permittedColumns);
}
permittedColumns = addPermittedColumns( dd,
true /* grantable permissions */,
Authorizer.PUBLIC_AUTHORIZATION_ID,
permittedColumns);
permittedColumns = addPermittedColumns( dd,
true /* grantable permissions */,
authorizationId,
permittedColumns);
//DERBY-4191
//If we are looking for select privilege on ANY column,
//then we can quit as soon as we find some column with select
//privilege. This is needed for queries like
//select count(*) from t1
//select count(1) from t1
//select 1 from t1
//select t1.c1 from t1, t2
if (privType == Authorizer.MIN_SELECT_PRIV && permittedColumns != null)
return;
FormatableBitSet unresolvedColumns = (FormatableBitSet)columns.clone();
for (int i = unresolvedColumns.anySetBit();
i >= 0;
i = unresolvedColumns.anySetBit(i)) {
if (permittedColumns != null && permittedColumns.get(i)) {
// column i (zero-based here) accounted for:
unresolvedColumns.clear(i);
}
}
if (unresolvedColumns.anySetBit() < 0) {
// all ok
return;
}
// If columns are still unauthorized, look to role closure for
// resolution.
String role = lcc.getCurrentRoleId(activation);
RoleGrantDescriptor rd = null;
if (role != null) {
// Check that role is still granted to current user or
// to PUBLIC: A revoked role which is current for this
// session, is lazily set to none when it is attempted
// used.
String dbo = dd.getAuthorizationDatabaseOwner();
rd = dd.getRoleGrantDescriptor(role, authorizationId, dbo);
if (rd == null) {
rd = dd.getRoleGrantDescriptor
(role,
Authorizer.PUBLIC_AUTHORIZATION_ID,
dbo);
}
if (rd == null) {
// we have lost the right to set this role, so we can't
// make use of any permission granted to it or its ancestors.
lcc.setCurrentRole(activation, null);
} else {
// The current role is OK, so we can make use of
// any permission granted to it.
//
// Look at the current role and, if necessary, the transitive
// closure of roles granted to current role to see if
// permission has been granted to any of the applicable roles.
RoleClosureIterator rci =
dd.createRoleClosureIterator
(activation.getTransactionController(),
role, true /* inverse relation*/);
String r;
while (unresolvedColumns.anySetBit() >= 0 &&
(r = rci.next()) != null ) {
//The user does not have needed privilege directly
//granted to it, so let's see if he has that privilege
//available to him/her through his roles.
permittedColumns = tryRole(lcc, dd, forGrant, r);
//DERBY-4191
//If we are looking for select privilege on ANY column,
//then we can quit as soon as we find some column with select
//privilege through this role. This is needed for queries like
//select count(*) from t1
//select count(1) from t1
//select 1 from t1
//select t1.c1 from t1, t2
if (privType == Authorizer.MIN_SELECT_PRIV && permittedColumns != null) {
DependencyManager dm = dd.getDependencyManager();
RoleGrantDescriptor rgd =
dd.getRoleDefinitionDescriptor(role);
ContextManager cm = lcc.getContextManager();
dm.addDependency(ps, rgd, cm);
dm.addDependency(activation, rgd, cm);
return;
}
//Use the privileges obtained through the role to satisfy
//the column level privileges we need. If all the remaining
//column level privileges are satisfied through this role,
//we will quit out of this while loop
for(int i = unresolvedColumns.anySetBit();
i >= 0;
i = unresolvedColumns.anySetBit(i)) {
if(permittedColumns != null && permittedColumns.get(i)) {
unresolvedColumns.clear(i);
}
}
}
}
}
TableDescriptor td = getTableDescriptor(dd);
//if we are still here, then that means that we didn't find any select
//privilege on the table or any column in the table
if (privType == Authorizer.MIN_SELECT_PRIV)
throw StandardException.newException( forGrant ? SQLState.AUTH_NO_TABLE_PERMISSION_FOR_GRANT
: SQLState.AUTH_NO_TABLE_PERMISSION,
authorizationId,
getPrivName(),
td.getSchemaName(),
td.getName());
int remains = unresolvedColumns.anySetBit();
if (remains >= 0) {
// No permission on this column.
ColumnDescriptor cd = td.getColumnDescriptor(remains + 1);