Bug #9505 Views: privilege needed on underlying function

Submitted: 31 Mar 2005 0:32 Modified: 31 Oct 2005 19:28
Reporter: Peter Gulutzan Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server Severity:S3 (Non-critical)
Version:5.0.4-beta-debug OS:Linux (SUSE 9.2)
Assigned to: Oleksandr Byelkin CPU Architecture:Any

[31 Mar 2005 0:32] Peter Gulutzan
Description:
If I have SELECT privilege on a view, I should not need EXECUTE privilege on the view's underlying function(s). But I do.

This bug will be easier to reproduce after bug#8137 is fixed.

How to repeat:
As user root, say:

mysql> delimiter //
mysql> create database db36//
Query OK, 1 row affected (0.00 sec)

mysql> use db36//
Database changed

mysql> create table t1 (s1 int)//
Query OK, 0 rows affected (0.01 sec)

mysql> grant select on t1 to user21@localhost//
Query OK, 0 rows affected (0.00 sec)

As user user21@localhost (on another shell and another copy of mysql client), say:

mysql> use db36;
Reading table information for completion of table and column names ...

As user root, say:

mysql> create table t2 (s1 int)//
Query OK, 0 rows affected (0.00 sec)

mysql> create function f2 () returns int begin declare v int; select s1 from t2 into v; return v; end//
Query OK, 0 rows affected (0.00 sec)

mysql> create view v2 as select f2()//
Query OK, 0 rows affected (0.00 sec)

mysql> grant select on v2 to user21@localhost//
Query OK, 0 rows affected (0.00 sec)

As user user21@localhost, say:

mysql> select * from v2;
ERROR 1370 (42000): execute command denied to user 'user21'@'localhost' for routine 'db36.f2'
[1 Jul 2005 9:21] Bugs System
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/internals/26580
[3 Jul 2005 20:21] Michael Widenius
Basic patch is ok, but the following needs yet to be done:
- Check during view create time that the creator of the view has right to execute the functions
- Add tests that shows that one can't create a view with a function that one doesn't have execute permission to
Same goes for prepared statements:
- Add example of preparation in PS statement with SP on which you have not rights
[18 Sep 2005 23:19] Bugs System
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/internals/30026
[27 Oct 2005 21:19] Bugs System
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/internals/31583
[28 Oct 2005 12:04] Oleksandr Byelkin
Thank you for bugreport!
Bugfix pushed to the 5.0.16 tree
[31 Oct 2005 19:28] Paul DuBois
Noted in 5.0.16 changelog.

Portions of this website are copyright © 2001, 2002 The PHP Group

Page generated in 0.040 sec. using MySQL 8.4.7-u6-cloud

Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the respective copyright holders.
It is not reviewed in advance by Oracle and does not necessarily represent the opinion of Oracle or any other party.