Skip to content

Regression in 4.x and 5.x. DB-LEVEL triggers can not be created just after CREATE DATABASE, RE-connect is reruired #9113

Description

@pavel-zotov

None of the following scripts will complete on recent 4.x and 5.x:

create database 'localhost:r:\temp\tmp4test.fdb' user sysdba password 'masterkey';
commit;
--connect 'localhost:r:\temp\tmp4test.fdb' user sysdba password 'masterkey';  --------- [ 1 ]
set term ^;
create trigger trg_commit active on transaction commit as
begin
    -- nop --
end
^
create database 'localhost:r:\temp\tmp4test.fdb' user sysdba password 'masterkey';
commit;
--connect 'localhost:r:\temp\tmp4test.fdb' user sysdba password 'masterkey'; --------- [ 1 ]
set term ^;
create trigger trg_alter_table_before active before ALTER TABLE as
begin
    -- nop --
end
^

Output will be:

Statement failed, SQLSTATE = 28000
unsuccessful metadata update
-CREATE TRIGGER <trg_name> failed
-no permission for ALTER access to DATABASE

If we UNcomment 'CONNECT ...' operator (marked as "[ 1 ]") than both scripts work fine.

3.x and 6.x seems not affected.
On 5.x problem not existed up to 20260720_192642-5.0.5.1868-243c173 and raises in 20260721_100938-5.0.5.1869-04f06fd -- i.e. since

commit 04f06fdca8f52effdc8cc9a8bf24934a2110d314
Author:     ChudaykinAlex <130781208+ChudaykinAlex@users.noreply.github.com>
AuthorDate: Tue Jul 21 11:03:14 2026 +0300
Commit:     Dmitry Yemanov <dyemanov@users.noreply.github.com>
CommitDate: Tue Jul 21 13:09:38 2026 +0300

    Merge commit from fork
    
    * Fix #GHSA-ph3g-gc8r-mjh5: USE_NBACKUP_UTILITY allowed full ALTER DATABASE
    
      SCL_check_database() contained a shortcut that granted any holder of
      USE_NBACKUP_UTILITY permission for all ALTER DATABASE clauses, not just
      backup-related ones (BEGIN/END BACKUP, ADD/DROP DIFFERENCE FILE).
    
      - Remove the shortcut from SCL_check_database() in scl.epp
      - Make AlterDatabaseNode::checkPermission() clause-aware: allow
        USE_NBACKUP_UTILITY only when no non-backup clauses are present
    
    * USE_NBACKUP_UTILITY: require full ALTER DATABASE for difference file

This is URL to 5.x snapshots that can be used to check this issue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions