Bug #28662 MyODBC 3/Access When linking a table using a DSN mysql system tables are shown
Submitted: 24 May 2007 23:35 Modified: 20 Jul 2007 13:37
Reporter: Eric MaLossi
Status: Closed
Category:Connector/ODBC Severity:S2 (Serious)
Version:3.51.14 OS:Microsoft Windows (XP sp2)
Assigned to: Jim Winstead Target Version:
Tags: SQLTables

[24 May 2007 23:35] Eric MaLossi 
Description:
If you link a table in Access to a mysql database using a DSN that points to a database
other than the mysql database, then in the resulting "Link Tables" dialog all of the mysql
system tables are displayed in addition to the tables of the requested database.

This doesn't seem to occur if the user hasn't been granted any permissions to the mysql
database (although all permutations of grants have not been tried), however it does seem
that this could lead to potential security problems or at least the danger of
inadvertently displaying or corrupting the system tables

How to repeat:
In mysql:
CREATE DATABASE ado;
USE ADO;
CREATE TABLE t (C1 INT PRIMARY KEY);
GRANT SELECT ON ado.* TO 'foo'@'localhost' IDENTIFIED BY 'bar';
GRANT SELECT ON mysql.* TO 'foo'@'localhost';

In the ODBC Data Source Administrator:
Click Add
Select MyODBC 3.51 as the provider
Data Source Name = system table test
Server = localhost
User = foo
Password = bar
Database = ado

In Access:
Create a new database
Select File / Get External Data / Link Tables
Select ODBC Databases() from the "Files of Type" drop down 
Select the Machine Data Source tab
Select the "system table test" DSN
Examine the tables in the "Link Tables" dialog and note that the mysql system tables are
shown in addition to the test table "t"

Cleanup:
revoke all on mysql.* from 'foo'@'localhost';
revoke all on ado.* from 'foo'@'localhost';
drop user 'foo'@'localhost';
drop table t;
drop database ado;
[25 May 2007 0:36] Jim Winstead 
this behavior is actually intentional, but i don't see how it is at all desirable. ripping
out the code that does this will make me very happy.
[9 Jul 2007 19:38] Jim Winstead 
Remove silly hack for SYSTEM TABLE (correct patch)

Attachment: bug28662.patch (text/plain), 12.45 KiB.
[18 Jul 2007 19:00] Jim Winstead 
The fix for this bug has been committed, and will be in 3.51.18.
[20 Jul 2007 13:37] MC Brown 
A note has been added to the 3.51.17 changelog: 

When connecting to a specific database using the DSN, the
system tables from the mysql database are no longer
also available.
[20 Jul 2007 13:37] MC Brown 
Correction - added to the 3.51.18 changelog.
[26 Jul 2007 0:17] Jess Balint 
Bug#29873 marked as a duplicate of this one.