Issue 471: CREATE VIEW does not check user rights, patch from Andrew Franklin

h2/src/docsrc/html/changelog.html

@@ -37,6 +37,7 @@ Change Log
 </li><li>Issue 478: Support for "SHOW TRANSACTION ISOLATION LEVEL", patch from Andrew Franklin
 </li><li>Issue 475: PgServer: add support for CancelRequest, patch from Andrew Franklin
 </li><li>Issue 473: PgServer missing -key option, patch from Andrew Franklin
+</li><li>Issue 471: CREATE VIEW does not check user rights, patch from Andrew Franklin
 </li></ul>
 
 <h2>Version 1.3.172 (2013-05-25)</h2>

h2/src/main/org/h2/command/ddl/CreateView.java

@@ -73,6 +73,7 @@ public class CreateView extends SchemaCommand {
     @Override
     public int update() {
         session.commit(true);
+        session.getUser().checkAdmin();
         Database db = session.getDatabase();
         TableView view = null;
         Table old = getSchema().findTableOrView(session, viewName);

h2/src/test/org/h2/test/db/TestRights.java

@@ -234,6 +234,8 @@ public class TestRights extends TestBase {
         executeError("SELECT * FROM (SELECT * FROM PASS)");
         assertThrows(ErrorCode.TABLE_OR_VIEW_NOT_FOUND_1, stat).
                 execute("CREATE VIEW X AS SELECT * FROM PASS_READER");
+        assertThrows(ErrorCode.ADMIN_RIGHTS_REQUIRED, stat).
+                execute("CREATE VIEW X AS SELECT * FROM PASS_NAME");
         conn.close();
 
         conn = getConnection("rights");