{"action":"created","comment":{"url":"https://api.github.com/repos/pingcap/tidb/pulls/comments/42704772","id":42704772,"diff_hunk":"@@ -0,0 +1,254 @@\n+// Copyright 2015 PingCAP, Inc.\n+//\n+// Licensed under the Apache License, Version 2.0 (the \"License\");\n+// you may not use this file except in compliance with the License.\n+// You may obtain a copy of the License at\n+//\n+//     http://www.apache.org/licenses/LICENSE-2.0\n+//\n+// Unless required by applicable law or agreed to in writing, software\n+// distributed under the License is distributed on an \"AS IS\" BASIS,\n+// See the License for the specific language governing permissions and\n+// limitations under the License.\n+\n+package privileges\n+\n+import (\n+\t\"fmt\"\n+\t\"strings\"\n+\n+\t\"github.com/juju/errors\"\n+\t\"github.com/pingcap/tidb/context\"\n+\t\"github.com/pingcap/tidb/model\"\n+\t\"github.com/pingcap/tidb/mysql\"\n+\t\"github.com/pingcap/tidb/privilege\"\n+\t\"github.com/pingcap/tidb/sessionctx/variable\"\n+\t\"github.com/pingcap/tidb/util/sqlexec\"\n+)\n+\n+var _ privilege.Checker = (*PrivilegeCheck)(nil)\n+\n+type userPrivilege struct {\n+\tGlobalPrivs map[mysql.PrivilegeType]bool\n+\tDBPrivs     map[string]map[mysql.PrivilegeType]bool\n+\tTablePrivs  map[string]map[string]map[mysql.PrivilegeType]bool\n+}\n+\n+// PrivilegeCheck implements privilege.Checker interface.\n+// This is used to check privilege for the current user.\n+type PrivilegeCheck struct {\n+\tusername string\n+\thost     string\n+\tprivs    *userPrivilege\n+}\n+\n+// CheckDBPrivilege implements PrivilegeChecker.CheckDBPrivilege interface.\n+func (p *PrivilegeCheck) CheckDBPrivilege(ctx context.Context, db *model.DBInfo, privilege mysql.PrivilegeType) (bool, error) {\n+\tif p.privs == nil {\n+\t\t// Lazy load\n+\t\terr := p.loadPrivileges(ctx)\n+\t\tif err != nil {\n+\t\t\treturn false, errors.Trace(err)\n+\t\t}\n+\t}\n+\t// Check global scope privileges.\n+\t_, ok := p.privs.GlobalPrivs[privilege]\n+\tif ok {\n+\t\treturn true, nil\n+\t}\n+\t// Check db scope privileges.\n+\tdbp, ok := p.privs.DBPrivs[db.Name.O]\n+\tif !ok {\n+\t\treturn false, nil\n+\t}\n+\t_, ok = dbp[privilege]\n+\treturn ok, nil\n+}\n+\n+// CheckTablePrivilege implements PrivilegeChecker.CheckTablePrivilege interface.\n+func (p *PrivilegeCheck) CheckTablePrivilege(ctx context.Context, db *model.DBInfo, tbl *model.TableInfo, privilege mysql.PrivilegeType) (bool, error) {\n+\tif p.privs == nil {\n+\t\t// Lazy load\n+\t\terr := p.loadPrivileges(ctx)\n+\t\tif err != nil {\n+\t\t\treturn false, errors.Trace(err)\n+\t\t}\n+\t}\n+\t// Check global scope privileges.\n+\t_, ok := p.privs.GlobalPrivs[privilege]\n+\tif ok {\n+\t\treturn true, nil\n+\t}\n+\t// Check db scope privileges.\n+\tdbp, ok := p.privs.DBPrivs[db.Name.O]\n+\tif ok {\n+\t\t_, ok = dbp[privilege]\n+\t\tif ok {\n+\t\t\treturn true, nil\n+\t\t}\n+\t}\n+\t// Check table scope privileges.\n+\ttblp, ok := p.privs.TablePrivs[db.Name.O]\n+\tif !ok {\n+\t\treturn false, nil\n+\t}\n+\t_, ok = tblp[tbl.Name.O]\n+\treturn ok, nil\n+}\n+\n+func (p *PrivilegeCheck) loadGlobalPrivileges(ctx context.Context) error {\n+\tsql := fmt.Sprintf(`SELECT * FROM %s.%s WHERE User=\"%s\" AND (Host=\"%s\" OR Host=\"%%\");`, mysql.SystemDB, mysql.UserTable, p.username, p.host)\n+\trs, err := ctx.(sqlexec.RestrictedSQLExecutor).ExecRestrictedSQL(ctx, sql)","path":"privilege/privileges/privileges.go","position":101,"original_position":101,"commit_id":"a05222a981b065fed08dc3c09c588a35c2104009","original_commit_id":"a05222a981b065fed08dc3c09c588a35c2104009","user":{"login":"shenli","id":1192573,"avatar_url":"https://avatars.githubusercontent.com/u/1192573?v=3","gravatar_id":"","url":"https://api.github.com/users/shenli","html_url":"https://github.com/shenli","followers_url":"https://api.github.com/users/shenli/followers","following_url":"https://api.github.com/users/shenli/following{/other_user}","gists_url":"https://api.github.com/users/shenli/gists{/gist_id}","starred_url":"https://api.github.com/users/shenli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shenli/subscriptions","organizations_url":"https://api.github.com/users/shenli/orgs","repos_url":"https://api.github.com/users/shenli/repos","events_url":"https://api.github.com/users/shenli/events{/privacy}","received_events_url":"https://api.github.com/users/shenli/received_events","type":"User","site_admin":false},"body":"session implements RestrictedSQLExecutor. But it already have a function named Execute. So Exec may be confused with Execute.","created_at":"2015-10-22T01:59:07Z","updated_at":"2015-10-22T01:59:07Z","html_url":"https://github.com/pingcap/tidb/pull/423#discussion_r42704772","pull_request_url":"https://api.github.com/repos/pingcap/tidb/pulls/423","_links":{"self":{"href":"https://api.github.com/repos/pingcap/tidb/pulls/comments/42704772"},"html":{"href":"https://github.com/pingcap/tidb/pull/423#discussion_r42704772"},"pull_request":{"href":"https://api.github.com/repos/pingcap/tidb/pulls/423"}}},"pull_request":{"url":"https://api.github.com/repos/pingcap/tidb/pulls/423","id":48173342,"html_url":"https://github.com/pingcap/tidb/pull/423","diff_url":"https://github.com/pingcap/tidb/pull/423.diff","patch_url":"https://github.com/pingcap/tidb/pull/423.patch","issue_url":"https://api.github.com/repos/pingcap/tidb/issues/423","number":423,"state":"open","locked":false,"title":"Add privilege checker and bind it to session","user":{"login":"shenli","id":1192573,"avatar_url":"https://avatars.githubusercontent.com/u/1192573?v=3","gravatar_id":"","url":"https://api.github.com/users/shenli","html_url":"https://github.com/shenli","followers_url":"https://api.github.com/users/shenli/followers","following_url":"https://api.github.com/users/shenli/following{/other_user}","gists_url":"https://api.github.com/users/shenli/gists{/gist_id}","starred_url":"https://api.github.com/users/shenli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shenli/subscriptions","organizations_url":"https://api.github.com/users/shenli/orgs","repos_url":"https://api.github.com/users/shenli/repos","events_url":"https://api.github.com/users/shenli/events{/privacy}","received_events_url":"https://api.github.com/users/shenli/received_events","type":"User","site_admin":false},"body":"","created_at":"2015-10-20T09:03:00Z","updated_at":"2015-10-22T01:59:07Z","closed_at":null,"merged_at":null,"merge_commit_sha":"444504dce7cd191527100c6c8d745479fc0a5fd6","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/pingcap/tidb/pulls/423/commits","review_comments_url":"https://api.github.com/repos/pingcap/tidb/pulls/423/comments","review_comment_url":"https://api.github.com/repos/pingcap/tidb/pulls/comments{/number}","comments_url":"https://api.github.com/repos/pingcap/tidb/issues/423/comments","statuses_url":"https://api.github.com/repos/pingcap/tidb/statuses/a05222a981b065fed08dc3c09c588a35c2104009","head":{"label":"pingcap:shenli/add-priv-step3","ref":"shenli/add-priv-step3","sha":"a05222a981b065fed08dc3c09c588a35c2104009","user":{"login":"pingcap","id":11855343,"avatar_url":"https://avatars.githubusercontent.com/u/11855343?v=3","gravatar_id":"","url":"https://api.github.com/users/pingcap","html_url":"https://github.com/pingcap","followers_url":"https://api.github.com/users/pingcap/followers","following_url":"https://api.github.com/users/pingcap/following{/other_user}","gists_url":"https://api.github.com/users/pingcap/gists{/gist_id}","starred_url":"https://api.github.com/users/pingcap/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pingcap/subscriptions","organizations_url":"https://api.github.com/users/pingcap/orgs","repos_url":"https://api.github.com/users/pingcap/repos","events_url":"https://api.github.com/users/pingcap/events{/privacy}","received_events_url":"https://api.github.com/users/pingcap/received_events","type":"Organization","site_admin":false},"repo":{"id":41986369,"name":"tidb","full_name":"pingcap/tidb","owner":{"login":"pingcap","id":11855343,"avatar_url":"https://avatars.githubusercontent.com/u/11855343?v=3","gravatar_id":"","url":"https://api.github.com/users/pingcap","html_url":"https://github.com/pingcap","followers_url":"https://api.github.com/users/pingcap/followers","following_url":"https://api.github.com/users/pingcap/following{/other_user}","gists_url":"https://api.github.com/users/pingcap/gists{/gist_id}","starred_url":"https://api.github.com/users/pingcap/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pingcap/subscriptions","organizations_url":"https://api.github.com/users/pingcap/orgs","repos_url":"https://api.github.com/users/pingcap/repos","events_url":"https://api.github.com/users/pingcap/events{/privacy}","received_events_url":"https://api.github.com/users/pingcap/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/pingcap/tidb","description":"TiDB is a distributed SQL database compatible with MySQL protocol.","fork":false,"url":"https://api.github.com/repos/pingcap/tidb","forks_url":"https://api.github.com/repos/pingcap/tidb/forks","keys_url":"https://api.github.com/repos/pingcap/tidb/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pingcap/tidb/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pingcap/tidb/teams","hooks_url":"https://api.github.com/repos/pingcap/tidb/hooks","issue_events_url":"https://api.github.com/repos/pingcap/tidb/issues/events{/number}","events_url":"https://api.github.com/repos/pingcap/tidb/events","assignees_url":"https://api.github.com/repos/pingcap/tidb/assignees{/user}","branches_url":"https://api.github.com/repos/pingcap/tidb/branches{/branch}","tags_url":"https://api.github.com/repos/pingcap/tidb/tags","blobs_url":"https://api.github.com/repos/pingcap/tidb/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pingcap/tidb/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pingcap/tidb/git/refs{/sha}","trees_url":"https://api.github.com/repos/pingcap/tidb/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pingcap/tidb/statuses/{sha}","languages_url":"https://api.github.com/repos/pingcap/tidb/languages","stargazers_url":"https://api.github.com/repos/pingcap/tidb/stargazers","contributors_url":"https://api.github.com/repos/pingcap/tidb/contributors","subscribers_url":"https://api.github.com/repos/pingcap/tidb/subscribers","subscription_url":"https://api.github.com/repos/pingcap/tidb/subscription","commits_url":"https://api.github.com/repos/pingcap/tidb/commits{/sha}","git_commits_url":"https://api.github.com/repos/pingcap/tidb/git/commits{/sha}","comments_url":"https://api.github.com/repos/pingcap/tidb/comments{/number}","issue_comment_url":"https://api.github.com/repos/pingcap/tidb/issues/comments{/number}","contents_url":"https://api.github.com/repos/pingcap/tidb/contents/{+path}","compare_url":"https://api.github.com/repos/pingcap/tidb/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pingcap/tidb/merges","archive_url":"https://api.github.com/repos/pingcap/tidb/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pingcap/tidb/downloads","issues_url":"https://api.github.com/repos/pingcap/tidb/issues{/number}","pulls_url":"https://api.github.com/repos/pingcap/tidb/pulls{/number}","milestones_url":"https://api.github.com/repos/pingcap/tidb/milestones{/number}","notifications_url":"https://api.github.com/repos/pingcap/tidb/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pingcap/tidb/labels{/name}","releases_url":"https://api.github.com/repos/pingcap/tidb/releases{/id}","created_at":"2015-09-06T04:01:52Z","updated_at":"2015-10-22T01:26:00Z","pushed_at":"2015-10-22T01:55:03Z","git_url":"git://github.com/pingcap/tidb.git","ssh_url":"git@github.com:pingcap/tidb.git","clone_url":"https://github.com/pingcap/tidb.git","svn_url":"https://github.com/pingcap/tidb","homepage":"","size":11741,"stargazers_count":2673,"watchers_count":2673,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":260,"mirror_url":null,"open_issues_count":51,"forks":260,"open_issues":51,"watchers":2673,"default_branch":"master"}},"base":{"label":"pingcap:master","ref":"master","sha":"3e1f2f9982aa8f2dbafa77f8b935a22802b5ec5e","user":{"login":"pingcap","id":11855343,"avatar_url":"https://avatars.githubusercontent.com/u/11855343?v=3","gravatar_id":"","url":"https://api.github.com/users/pingcap","html_url":"https://github.com/pingcap","followers_url":"https://api.github.com/users/pingcap/followers","following_url":"https://api.github.com/users/pingcap/following{/other_user}","gists_url":"https://api.github.com/users/pingcap/gists{/gist_id}","starred_url":"https://api.github.com/users/pingcap/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pingcap/subscriptions","organizations_url":"https://api.github.com/users/pingcap/orgs","repos_url":"https://api.github.com/users/pingcap/repos","events_url":"https://api.github.com/users/pingcap/events{/privacy}","received_events_url":"https://api.github.com/users/pingcap/received_events","type":"Organization","site_admin":false},"repo":{"id":41986369,"name":"tidb","full_name":"pingcap/tidb","owner":{"login":"pingcap","id":11855343,"avatar_url":"https://avatars.githubusercontent.com/u/11855343?v=3","gravatar_id":"","url":"https://api.github.com/users/pingcap","html_url":"https://github.com/pingcap","followers_url":"https://api.github.com/users/pingcap/followers","following_url":"https://api.github.com/users/pingcap/following{/other_user}","gists_url":"https://api.github.com/users/pingcap/gists{/gist_id}","starred_url":"https://api.github.com/users/pingcap/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pingcap/subscriptions","organizations_url":"https://api.github.com/users/pingcap/orgs","repos_url":"https://api.github.com/users/pingcap/repos","events_url":"https://api.github.com/users/pingcap/events{/privacy}","received_events_url":"https://api.github.com/users/pingcap/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/pingcap/tidb","description":"TiDB is a distributed SQL database compatible with MySQL protocol.","fork":false,"url":"https://api.github.com/repos/pingcap/tidb","forks_url":"https://api.github.com/repos/pingcap/tidb/forks","keys_url":"https://api.github.com/repos/pingcap/tidb/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pingcap/tidb/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pingcap/tidb/teams","hooks_url":"https://api.github.com/repos/pingcap/tidb/hooks","issue_events_url":"https://api.github.com/repos/pingcap/tidb/issues/events{/number}","events_url":"https://api.github.com/repos/pingcap/tidb/events","assignees_url":"https://api.github.com/repos/pingcap/tidb/assignees{/user}","branches_url":"https://api.github.com/repos/pingcap/tidb/branches{/branch}","tags_url":"https://api.github.com/repos/pingcap/tidb/tags","blobs_url":"https://api.github.com/repos/pingcap/tidb/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pingcap/tidb/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pingcap/tidb/git/refs{/sha}","trees_url":"https://api.github.com/repos/pingcap/tidb/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pingcap/tidb/statuses/{sha}","languages_url":"https://api.github.com/repos/pingcap/tidb/languages","stargazers_url":"https://api.github.com/repos/pingcap/tidb/stargazers","contributors_url":"https://api.github.com/repos/pingcap/tidb/contributors","subscribers_url":"https://api.github.com/repos/pingcap/tidb/subscribers","subscription_url":"https://api.github.com/repos/pingcap/tidb/subscription","commits_url":"https://api.github.com/repos/pingcap/tidb/commits{/sha}","git_commits_url":"https://api.github.com/repos/pingcap/tidb/git/commits{/sha}","comments_url":"https://api.github.com/repos/pingcap/tidb/comments{/number}","issue_comment_url":"https://api.github.com/repos/pingcap/tidb/issues/comments{/number}","contents_url":"https://api.github.com/repos/pingcap/tidb/contents/{+path}","compare_url":"https://api.github.com/repos/pingcap/tidb/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pingcap/tidb/merges","archive_url":"https://api.github.com/repos/pingcap/tidb/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pingcap/tidb/downloads","issues_url":"https://api.github.com/repos/pingcap/tidb/issues{/number}","pulls_url":"https://api.github.com/repos/pingcap/tidb/pulls{/number}","milestones_url":"https://api.github.com/repos/pingcap/tidb/milestones{/number}","notifications_url":"https://api.github.com/repos/pingcap/tidb/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pingcap/tidb/labels{/name}","releases_url":"https://api.github.com/repos/pingcap/tidb/releases{/id}","created_at":"2015-09-06T04:01:52Z","updated_at":"2015-10-22T01:26:00Z","pushed_at":"2015-10-22T01:55:03Z","git_url":"git://github.com/pingcap/tidb.git","ssh_url":"git@github.com:pingcap/tidb.git","clone_url":"https://github.com/pingcap/tidb.git","svn_url":"https://github.com/pingcap/tidb","homepage":"","size":11741,"stargazers_count":2673,"watchers_count":2673,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":260,"mirror_url":null,"open_issues_count":51,"forks":260,"open_issues":51,"watchers":2673,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/pingcap/tidb/pulls/423"},"html":{"href":"https://github.com/pingcap/tidb/pull/423"},"issue":{"href":"https://api.github.com/repos/pingcap/tidb/issues/423"},"comments":{"href":"https://api.github.com/repos/pingcap/tidb/issues/423/comments"},"review_comments":{"href":"https://api.github.com/repos/pingcap/tidb/pulls/423/comments"},"review_comment":{"href":"https://api.github.com/repos/pingcap/tidb/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/pingcap/tidb/pulls/423/commits"},"statuses":{"href":"https://api.github.com/repos/pingcap/tidb/statuses/a05222a981b065fed08dc3c09c588a35c2104009"}}}}