Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 4a33fcc

Browse files
Stash
[ci skip]
1 parent f7f8019 commit 4a33fcc

File tree

4 files changed

+86
-15
lines changed

4 files changed

+86
-15
lines changed

‎sqlite3.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1308,7 +1308,7 @@ func (d *SQLiteDriver) Open(dsn string) (driver.Conn, error) {
13081308
//
13091309
// If the SQLITE_USER table is not present in the database file, then
13101310
// this interface is a harmless no-op returnning SQLITE_OK.
1311-
if err := conn.RegisterFunc("authenticate", conn.Authenticate, true); err != nil {
1311+
if err := conn.RegisterFunc("authenticate", conn.Authenticate, false); err != nil {
13121312
return nil, err
13131313
}
13141314
//
@@ -1321,7 +1321,7 @@ func (d *SQLiteDriver) Open(dsn string) (driver.Conn, error) {
13211321
// The AuthUserAdd only works for the "main" database, not
13221322
// for any ATTACH-ed databases. Any call to AuthUserAdd by a
13231323
// non-admin user results in an error.
1324-
if err := conn.RegisterFunc("auth_user_add", conn.AuthUserAdd, true); err != nil {
1324+
if err := conn.RegisterFunc("auth_user_add", conn.AuthUserAdd, false); err != nil {
13251325
return nil, err
13261326
}
13271327
//
@@ -1330,7 +1330,7 @@ func (d *SQLiteDriver) Open(dsn string) (driver.Conn, error) {
13301330
// login credentials. Only an admin user can change another users login
13311331
// credentials or admin privilege setting. No user may change their own
13321332
// admin privilege setting.
1333-
if err := conn.RegisterFunc("auth_user_change", conn.AuthUserChange, true); err != nil {
1333+
if err := conn.RegisterFunc("auth_user_change", conn.AuthUserChange, false); err != nil {
13341334
return nil, err
13351335
}
13361336
//
@@ -1339,7 +1339,7 @@ func (d *SQLiteDriver) Open(dsn string) (driver.Conn, error) {
13391339
// which guarantees that there is always an admin user and hence that
13401340
// the database cannot be converted into a no-authentication-required
13411341
// database.
1342-
if err := conn.RegisterFunc("auth_user_delete", conn.AuthUserDelete, true); err != nil {
1342+
if err := conn.RegisterFunc("auth_user_delete", conn.AuthUserDelete, false); err != nil {
13431343
return nil, err
13441344
}
13451345

‎sqlite3_opt_userauth.go‎

Lines changed: 28 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -60,13 +60,19 @@ _sqlite3_auth_is_enabled(sqlite3* db)
6060
*/
6161
import "C"
6262
import (
63+
"errors"
6364
"unsafe"
6465
)
6566

6667
const (
6768
SQLITE_AUTH = C.SQLITE_AUTH
6869
)
6970

71+
var (
72+
ErrUnauthorized = errors.New("SQLITE_AUTH: Unauthorized")
73+
ErrAdminRequired = errors.New("SQLITE_AUTH: Unauthorized; Admin Privileges Required")
74+
)
75+
7076
// Authenticate will perform an authentication of the provided username
7177
// and password against the database.
7278
//
@@ -92,6 +98,9 @@ func (c *SQLiteConn) Authenticate(username, password string) error {
9298
}()
9399

94100
rv := C._sqlite3_user_authenticate(c.db, cuser, cpass, C.int(len(password)))
101+
if rv == C.SQLITE_AUTH {
102+
return ErrUnauthorized
103+
}
95104
if rv != C.SQLITE_OK {
96105
return c.lastError()
97106
}
@@ -113,6 +122,18 @@ func (c *SQLiteConn) AuthUserAdd(username, password string, admin bool) error {
113122
isAdmin = 1
114123
}
115124

125+
rv := c.authUserAdd(username, password, isAdmin)
126+
switch rv {
127+
case C.SQLITE_AUTH:
128+
return ErrAdminRequired
129+
case C.SQLITE_OK:
130+
return nil
131+
default:
132+
return c.lastError()
133+
}
134+
}
135+
136+
func (c *SQLiteConn) authUserAdd(username, password string, admin int) int {
116137
// Allocate C Variables
117138
cuser := C.CString(username)
118139
cpass := C.CString(password)
@@ -123,12 +144,7 @@ func (c *SQLiteConn) AuthUserAdd(username, password string, admin bool) error {
123144
C.free(unsafe.Pointer(cpass))
124145
}()
125146

126-
rv := C._sqlite3_user_add(c.db, cuser, cpass, C.int(len(password)), C.int(isAdmin))
127-
if rv != C.SQLITE_OK {
128-
return c.lastError()
129-
}
130-
131-
return nil
147+
return int(C._sqlite3_user_add(c.db, cuser, cpass, C.int(len(password)), C.int(admin)))
132148
}
133149

134150
// AuthUserChange can be used to change a users
@@ -153,6 +169,9 @@ func (c *SQLiteConn) AuthUserChange(username, password string, admin bool) error
153169
}()
154170

155171
rv := C._sqlite3_user_change(c.db, cuser, cpass, C.int(len(password)), C.int(isAdmin))
172+
if rv == C.SQLITE_AUTH {
173+
return ErrAdminRequired
174+
}
156175
if rv != C.SQLITE_OK {
157176
return c.lastError()
158177
}
@@ -175,6 +194,9 @@ func (c *SQLiteConn) AuthUserDelete(username string) error {
175194
}()
176195

177196
rv := C._sqlite3_user_delete(c.db, cuser)
197+
if rv == SQLITE_AUTH {
198+
return ErrAdminRequired
199+
}
178200
if rv != C.SQLITE_OK {
179201
return c.lastError()
180202
}

‎sqlite3_opt_userauth_omit.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,4 +62,9 @@ func (c *SQLiteConn) AuthUserDelete(username string) error {
6262
return nil
6363
}
6464

65+
// Check is database is protected by user authentication
66+
func (c *SQLiteConn) AuthIsEnabled() (exists bool) {
67+
return
68+
}
69+
6570
// EOF

‎sqlite3_opt_userauth_test.go‎

Lines changed: 49 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ package sqlite3
99

1010
import (
1111
"database/sql"
12+
"fmt"
1213
"os"
1314
"testing"
1415
)
@@ -23,11 +24,6 @@ func TestAuthCreateDatabase(t *testing.T) {
2324
}
2425
defer db.Close()
2526

26-
// Ping database
27-
if err := db.Ping(); err != nil {
28-
t.Fatal(err)
29-
}
30-
3127
var exists bool
3228
err = db.QueryRow("select count(type) from sqlite_master WHERE type='table' and name='sqlite_user';").Scan(&exists)
3329
if err != nil {
@@ -38,3 +34,51 @@ func TestAuthCreateDatabase(t *testing.T) {
3834
t.Fatal("failed to enable User Authentication")
3935
}
4036
}
37+
38+
func TestAuthorization(t *testing.T) {
39+
tempFilename := TempFilename(t)
40+
fmt.Println(tempFilename)
41+
//defer os.Remove(tempFilename)
42+
43+
db, err := sql.Open("sqlite3", "file:"+tempFilename+"?_auth&_auth_user=admin&_auth_pass=admin")
44+
if err != nil {
45+
t.Fatal("Failed to open database:", err)
46+
}
47+
48+
if _, err := db.Exec("select auth_user_add('user', 'user', false);"); err != nil {
49+
t.Fatal(err)
50+
}
51+
52+
var uname string
53+
if err := db.QueryRow("select uname from sqlite_user where uname = 'user';").Scan(&uname); err != nil {
54+
t.Fatal(err)
55+
}
56+
57+
if uname != "user" {
58+
t.Fatal("Failed to create normal user")
59+
}
60+
db.Close()
61+
62+
// Re-Open Database as User
63+
// Add User should now fail because we are not admin
64+
db, err = sql.Open("sqlite3", "file:"+tempFilename+"?_auth_user=user&_auth_pass=user")
65+
if err != nil {
66+
t.Fatal("Failed to open database:", err)
67+
}
68+
defer db.Close()
69+
70+
// Try to create normal user
71+
var rv string
72+
if err := db.QueryRow("select auth_user_add('user2', 'user2', false);").Scan(&rv); err != nil {
73+
t.Fatal(err)
74+
}
75+
fmt.Printf("RV: %v\n", rv)
76+
// if rv != SQLITE_AUTH {
77+
// t.Fatal("Succeeded creating user while not admin")
78+
// }
79+
80+
// // Try to create admin user
81+
// if _, err := db.Exec("select auth_user_add('admin2', 'admin2', true);"); err != nil {
82+
// t.Fatal(err)
83+
// }
84+
}

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /