None of the following scripts will complete on recent 4.x and 5.x:
create database 'localhost:r:\temp\tmp4test.fdb' user sysdba password 'masterkey';
commit;
--connect 'localhost:r:\temp\tmp4test.fdb' user sysdba password 'masterkey'; --------- [ 1 ]
set term ^;
create trigger trg_commit active on transaction commit as
begin
-- nop --
end
^
create database 'localhost:r:\temp\tmp4test.fdb' user sysdba password 'masterkey';
commit;
--connect 'localhost:r:\temp\tmp4test.fdb' user sysdba password 'masterkey'; --------- [ 1 ]
set term ^;
create trigger trg_alter_table_before active before ALTER TABLE as
begin
-- nop --
end
^
Output will be:
Statement failed, SQLSTATE = 28000
unsuccessful metadata update
-CREATE TRIGGER <trg_name> failed
-no permission for ALTER access to DATABASE
If we UNcomment 'CONNECT ...' operator (marked as "[ 1 ]") than both scripts work fine.
3.x and 6.x seems not affected.
On 5.x problem not existed up to 20260720_192642-5.0.5.1868-243c173 and raises in 20260721_100938-5.0.5.1869-04f06fd -- i.e. since
commit 04f06fdca8f52effdc8cc9a8bf24934a2110d314
Author: ChudaykinAlex <130781208+ChudaykinAlex@users.noreply.github.com>
AuthorDate: Tue Jul 21 11:03:14 2026 +0300
Commit: Dmitry Yemanov <dyemanov@users.noreply.github.com>
CommitDate: Tue Jul 21 13:09:38 2026 +0300
Merge commit from fork
* Fix #GHSA-ph3g-gc8r-mjh5: USE_NBACKUP_UTILITY allowed full ALTER DATABASE
SCL_check_database() contained a shortcut that granted any holder of
USE_NBACKUP_UTILITY permission for all ALTER DATABASE clauses, not just
backup-related ones (BEGIN/END BACKUP, ADD/DROP DIFFERENCE FILE).
- Remove the shortcut from SCL_check_database() in scl.epp
- Make AlterDatabaseNode::checkPermission() clause-aware: allow
USE_NBACKUP_UTILITY only when no non-backup clauses are present
* USE_NBACKUP_UTILITY: require full ALTER DATABASE for difference file
This is URL to 5.x snapshots that can be used to check this issue.
None of the following scripts will complete on recent 4.x and 5.x:
Output will be:
If we UNcomment 'CONNECT ...' operator (marked as "[ 1 ]") than both scripts work fine.
3.x and 6.x seems not affected.
On 5.x problem not existed up to
20260720_192642-5.0.5.1868-243c173and raises in20260721_100938-5.0.5.1869-04f06fd-- i.e. sinceThis is URL to 5.x snapshots that can be used to check this issue.