Description:
"SHOW INDEX FROM t" should require the same privileges like "SELECT * FROM I_S.STATISTICS
WHERE table_name='t'" but it doesn't.
How to repeat:
use mysqltest_db1;
CREATE TABLE t5 (s1 INT);
CREATE INDEX i ON t5 (s1);
CREATE TABLE t6 (s1 INT, s2 INT);
CREATE INDEX i ON t6 (s1);
GRANT UPDATE (s2) ON t6 to mysqltest_u1@localhost;
connection con1;
use mysqltest_db1;
--echo ** Connect as restricted user mysqltest_u1.
--echo ** SELECT FROM INFORMATION_SCHEMA.STATISTICS will succeed because any privileges
will do (authentication seems to be enough).
SELECT * FROM INFORMATION_SCHEMA.STATISTICS WHERE table_name='t5';
--echo ** SHOW INDEX FROM t5 will fail because we don't have any privileges on any column
combination.
--error 1142
SHOW INDEX FROM t5;
Suggested fix:
In get_all_tables all databases referenced in the sql condition is iterated and access is
granted as:
if (!check_access(thd,SELECT_ACL, db_name->str,
&thd->col_access, 0, 1, with_i_schema) ||
sctx->master_access & (DB_ACLS | SHOW_DB_ACL) ||
acl_get(sctx->host, sctx->ip, sctx->priv_user, db_name->str, 0) ||
!check_grant_db(thd, db_name->str))
Where the documentation for check_db_grant states that
"Access is accepted if he has a grant for any table/routine in the database"
This check possibly needs to be refined and in the case of I_S.STATISTICS the privilege
check should be against User | (DB&Host)
Description: "SHOW INDEX FROM t" should require the same privileges like "SELECT * FROM I_S.STATISTICS WHERE table_name='t'" but it doesn't. How to repeat: use mysqltest_db1; CREATE TABLE t5 (s1 INT); CREATE INDEX i ON t5 (s1); CREATE TABLE t6 (s1 INT, s2 INT); CREATE INDEX i ON t6 (s1); GRANT UPDATE (s2) ON t6 to mysqltest_u1@localhost; connection con1; use mysqltest_db1; --echo ** Connect as restricted user mysqltest_u1. --echo ** SELECT FROM INFORMATION_SCHEMA.STATISTICS will succeed because any privileges will do (authentication seems to be enough). SELECT * FROM INFORMATION_SCHEMA.STATISTICS WHERE table_name='t5'; --echo ** SHOW INDEX FROM t5 will fail because we don't have any privileges on any column combination. --error 1142 SHOW INDEX FROM t5; Suggested fix: In get_all_tables all databases referenced in the sql condition is iterated and access is granted as: if (!check_access(thd,SELECT_ACL, db_name->str, &thd->col_access, 0, 1, with_i_schema) || sctx->master_access & (DB_ACLS | SHOW_DB_ACL) || acl_get(sctx->host, sctx->ip, sctx->priv_user, db_name->str, 0) || !check_grant_db(thd, db_name->str)) Where the documentation for check_db_grant states that "Access is accepted if he has a grant for any table/routine in the database" This check possibly needs to be refined and in the case of I_S.STATISTICS the privilege check should be against User | (DB&Host)