Simplified privilege checks for script imports in UDFs used in views

Detail name	Value
Changelog Number	4245
Type	Improvement
Status	Resolved
Fix Versions	EXASOL 6.0.0
Resolution Date	2017-03-16

Old behavior:
In the past, following scenario caused a privilege error:

• A first user creates a view with a UDF, which imports another script
• The first user grants SELECT on the view to a second user, but does not grant EXECUTE privileges for the second script
• When the second user queries the view, it will fail with an insufficient privileges for executing script UDF2 error

CREATE SCHEMA import_test;

CREATE JAVA SCALAR SCRIPT UDF2(dummy int) RETURNS varchar(1000) AS
// empty script, just for testing
/

CREATE OR REPLACE JAVA SCALAR SCRIPT UDF1() EMITS (x varchar(1000)) AS
%import UDF2;
class UDF1 {
 public static void run(ExaMetadata meta, ExaIterator iter) throws Exception {
 iter.emit("foo");
 }
}
/

CREATE VIEW udfview AS
SELECT UDF1();

CREATE USER user2 IDENTIFIED BY "user2";
GRANT CREATE SESSION to user2;
GRANT SELECT ON udfview TO user2;

connect user2/user2;

-- this will fail
select * from import_test.udfview;

New behavior:
The above example will now work, because dynamic privilege checks, required for importing scripts, are now done using the owner of the view enclosing the UDF instance.

Changed behavior

In case of views, the dynamic privilege check inside UDFs, required for importing other scripts, is now done using the owner of the view enclosing the UDF instance. See the issue description for details.