Column UPDATE permission required when updating only variable by Đonny

Active

Type:	Bug
ID:	770615
Opened:	11/9/2012 7:35:58 AM
Access Restriction:	Public

Workaround(s)

view

User(s) can reproduce this bug

When an UPDATE statement updates a variable it requires column update permissions.

Details (expand)

English

SQL Server 2008 R2

SQL Engine

Windows Server 2008 R2 (all editions)

English

1) Lets have a table that user webuser does not have rights to update.
2) Fake grant:
GRANT UPDATE ON dbo.DAL_Article (LAST_CHANGED) TO webuser;
Note: LAST_CHANGED is TIMESTAMP column in my table.
3) Update (run as webuser):
DECLARE @p int;
update [dbo].[DAL_Article]
set @p = 0

The UPDATE permission was denied on the column 'xxx' of the object 'DAL_Article", database 'RFE_Pangea_devel', schema 'dbo'.

No error, query works. I'm not updating any of columns

X64

0 attachments

Posted by ellight1 on 11/20/2012 at 6:00 AM

Construction of expression acceptable, function Column_Updated() returns the correct set of columns, but that seems illogical to check rights, as if all the columns are updated.

And what are the ways to change RowVersion, when no any other column can be changing (but updating referenced data, for example)?

Posted by Đonny on 11/19/2012 at 4:02 PM

Hello,
Entity Framework generates this strange query. I had had no idea that this is a valid syntax before we changed some permissions, EF stopped working and I started investigating.

Posted by Microsoft on 11/19/2012 at 2:55 PM

Hi Donny,

Would you first mind explaining why you are using the "set @p=0" within an UPDATE statement rather than just using it as it's own statement? Thanks.

Microsoft