MySQL Bugs: #28662: MyODBC 3/Access When linking a table using a DSN mysql system tables are shown

Bug #28662	MyODBC 3/Access When linking a table using a DSN mysql system tables are shown
Submitted:	24 May 2007 21:35	Modified:	20 Jul 2007 11:37
Reporter:	Erica Moss	Email Updates:
Status:	Closed	Impact on me:	None
Category:	Connector / ODBC	Severity:	S2 (Serious)
Version:	3.51.14	OS:	Windows (XP sp2)
Assigned to:	Jim Winstead	CPU Architecture:	Any
Tags:	SQLTables

Description:
If you link a table in Access to a mysql database using a DSN that points to a database other than the mysql database, then in the resulting "Link Tables" dialog all of the mysql system tables are displayed in addition to the tables of the requested database.

This doesn't seem to occur if the user hasn't been granted any permissions to the mysql database (although all permutations of grants have not been tried), however it does seem that this could lead to potential security problems or at least the danger of inadvertently displaying or corrupting the system tables

How to repeat:
In mysql:
CREATE DATABASE ado;
USE ADO;
CREATE TABLE t (C1 INT PRIMARY KEY);
GRANT SELECT ON ado.* TO 'foo'@'localhost' IDENTIFIED BY 'bar';
GRANT SELECT ON mysql.* TO 'foo'@'localhost';

In the ODBC Data Source Administrator:
Click Add
Select MyODBC 3.51 as the provider
Data Source Name = system table test
Server = localhost
User = foo
Password = bar
Database = ado

In Access:
Create a new database
Select File / Get External Data / Link Tables
Select ODBC Databases() from the "Files of Type" drop down 
Select the Machine Data Source tab
Select the "system table test" DSN
Examine the tables in the "Link Tables" dialog and note that the mysql system tables are shown in addition to the test table "t"

Cleanup:
revoke all on mysql.* from 'foo'@'localhost';
revoke all on ado.* from 'foo'@'localhost';
drop user 'foo'@'localhost';
drop table t;
drop database ado;

this behavior is actually intentional, but i don't see how it is at all desirable. ripping out the code that does this will make me very happy.

Remove silly hack for SYSTEM TABLE (correct patch)

Attachment: bug28662.patch (text/plain), 12.45 KiB.

The fix for this bug has been committed, and will be in 3.51.18.

A note has been added to the 3.51.17 changelog: 

When connecting to a specific database using the DSN, the
system tables from the mysql database are no longer
also available.

Correction - added to the 3.51.18 changelog.

Bug#29873 marked as a duplicate of this one.