Bug #34227 Replication permission error message is misleading
Submitted: 1 Feb 2008 13:36 Modified: 12 Nov 2009 14:24
Reporter: Bogdan Kecman Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server: Replication Severity:S3 (Non-critical)
Version:all OS:Any
Assigned to: Zhenxing He CPU Architecture:Any
Tags: error message

[1 Feb 2008 13:36] Bogdan Kecman 
Description:
We recently got the following error message from our 5.0.52 servers when running the following command: SHOW SLAVE STATUS

ERROR 1227 (42000): Access denied; you need the SUPER,REPLICATION CLIENT privilege for this operation

This message is misleading. I believe that SUPER or REPLICATION CLIENT privileges are necessary whereas the above statement implies (to me) that SUPER and REPLICATION CLIENT privileges are needed.

Certainly I tried creating a test user, granting it REPLICATION CLIENT permissions and running the command. This worked.

Perhaps you can adjust the error message to something like:

ERROR 1227 (42000): Access denied; you need the SUPER or REPLICATION CLIENT privilege for this operation
or
ERROR 1227 (42000): Access denied; you need one of the following privileges for this operation: SUPER,REPLICATION CLIENT

How to repeat:
without right privileges try:

mysql> SHOW SLAVE STATUS;
ERROR 1227 (42000): Access denied; you need the SUPER,REPLICATION CLIENT privilege for this operation

Suggested fix:
change the error message to

ERROR 1227 (42000): Access denied; you need one of the following privileges for this operation: SUPER,REPLICATION CLIENT
[10 Nov 2008 18:50] Sveta Smirnova 
Bug #40619 was marked as duplicate of this one.
[9 Mar 2009 8:30] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/68587

3112 He Zhenxing	2009-03-09
      BUG#34227 Replication permission error message is misleading
      
      Originally, function check_global_access allowed access if any 
      of the rights were held by the user, but when more then one 
      rights was check, there was no 'any of' or 'one of' before the
      list of rights in the error message to reflect this.
      
      Add a new argument 'all' to check_global_access function, which
      determins whether all or any of the rights are sufficient to 
      grant the access. And add 'any of' before the list of rights of
      the error message if 'all' is FALSE.
      
      If only one right is checked, or multiple rights are checked
      and all are required, then set 'all' to TRUE; If multiple
      rights are checked and any of them is sufficient, set 'all' to
      FALSE.
[12 Mar 2009 7:51] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/68996

3089 He Zhenxing	2009-03-12
      BUG#34227 Replication permission error message is misleading
      
      When multiple privileges are checked, and any of them is 
      sufficient, change the privileges separator from ',' to '|' in 
      the error message to make it clear that any (not all) of the
      privileges listed is sufficient to grant the access.
[12 Mar 2009 7:59] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/68997

3089 He Zhenxing	2009-03-12
      BUG#34227 Replication permission error message is misleading
      
      When multiple privileges are checked, and any of them is 
      sufficient, change the privileges separator from ',' to '|' in 
      the error message to make it clear that any (not all) of the
      privileges listed is sufficient to grant the access.
[24 Mar 2009 15:08] Andrei Elkin 
The pach is good, no changes in the code are need. Asked a question
about possbilly ambiguos comments.
[25 Mar 2009 8:08] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/70307

3089 He Zhenxing	2009-03-25
      BUG#34227 Replication permission error message is misleading
      
      When multiple privileges are checked via check_global_access(),
      and any of them is sufficient, change the privileges separator
      from ',' to '|' in the error message to make it clear that any
      (not all) of the privileges listed is sufficient to grant the
      access.
[25 Mar 2009 14:21] Andrei Elkin 
Zhen Xing, i am sorry to have missed the fact of 
lack of doxygination for the function that signature is changed by your patch.
Could you pls add a standard doxygen comments for it?
I'll approve the patch at once, thanks!

Andrei
[26 Mar 2009 6:34] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/70471

2834 He Zhenxing	2009-03-26
      BUG#34227 Replication permission error message is misleading
      
      When multiple privileges are checked via check_global_access(),
      and any of them is sufficient, change the privileges separator
      from ',' to '|' in the error message to make it clear that any
      (not all) of the privileges listed is sufficient to grant the
      access.
[30 Mar 2009 9:42] Zhenxing He 
pushed to 6.0-rpl
[16 Apr 2009 16:57] Bugs System 
Pushed into 6.0.11-alpha (revid:alik@sun.com-20090416165424-s5jp8a50cqy9zghk) (version source revid:zhenxing.he@sun.com-20090326063423-fdm5ltqlf84zop42) (merge vers: 6.0.11-alpha) (pib:6)
[17 Apr 2009 2:53] Jon Stephens 
Is there some reason why we can't just use plain English word ' or '?

I'm re-opening this bug and asking that this be done.
[17 Apr 2009 6:38] Zhenxing He 
Hi Jon,

The generated error message must be used for all languages, that's why I do not use 'or' in it.
[4 May 2009 12:46] Zhenxing He 
set back to documenting after reply to Jon's question
[6 May 2009 11:03] Jon Stephens 
I thought you were using the fix with "ERROR 1227 (42000): Access denied; you need one of the following privileges for this operation: SUPER,REPLICATION CLIENT"? 

In which case the comma would be perfectly correct, and the message itself would be pretty unambiguous. Better still would be

    ERROR 1227 (42000): Access denied; you need at least one of the following 
    privileges for this operation: SUPER, REPLICATION CLIENT 

which is completely unambiguous.
[10 May 2009 10:33] Zhenxing He 
I had thought about that, but the problem is that when there is only one privilege to check, then you'll get a error message like this:

    ERROR 1227 (42000): Access denied; you need one of the following 
    privileges for this operation: SUPER

And you cannot automatically generate the 'one of' because it has to be used for all languages, but as you pointed out, using '|' to separate privileges could be confusing, especially when there are privileges like 'REPLICATION CLIENT'.

If you think the above is OK, then I'll change ER_SPECIFIC_ACCESS_DENIED_ERROR to include 'one of' in it.
[11 May 2009 13:06] Jon Stephens 
I suggest:

you need (one of) the following privilege(s) for this operation: [list]
[11 May 2009 13:08] Jon Stephens 
Make that:

you need (at least one of) the following privilege(s) for this operation:

I think that's about as unambiguous as it gets. :)
[12 May 2009 10:27] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/73805
[19 May 2009 7:47] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/74450
[21 May 2009 6:25] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/74670

2857 He Zhenxing	2009-05-21
      Post fix of result files after push of BUG#34227
[22 May 2009 8:31] Zhenxing He 
pushed to 6.0-rpl
[16 Jun 2009 14:57] Bugs System 
Pushed into 5.4.4-alpha (revid:zhenxing.he@sun.com-20090612081554-kmu72j3wenjn82a8) (version source revid:zhenxing.he@sun.com-20090612034751-dqd4y0bv0iln1yaj) (merge vers: 5.4.4-alpha) (pib:7)
[17 Jun 2009 19:25] Bugs System 
Pushed into 5.4.4-alpha (revid:alik@sun.com-20090616183122-chjzbaa30qopdra9) (version source revid:zhenxing.he@sun.com-20090612034751-dqd4y0bv0iln1yaj) (merge vers: 5.4.4-alpha) (pib:11)
[24 Jun 2009 13:49] Jon Stephens 
Documented bugfix in the 5.4.4 changelog as follows:

      An error message relating to permissions required for SHOW SLAVE STATUS
      was confusing.
[12 Aug 2009 22:09] Paul DuBois 
Noted in 5.4.2 changelog because next 5.4 version will be 5.4.2 and not 5.4.4.
[14 Aug 2009 22:59] Paul DuBois 
Ignore previous comment about 5.4.2.
[2 Oct 2009 8:50] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/85485
[2 Oct 2009 9:12] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/85488

3123 He Zhenxing	2009-10-02
      Backport Post fix of result files after push of BUG#34227
[27 Oct 2009 9:48] Bugs System 
Pushed into 6.0.14-alpha (revid:alik@sun.com-20091027094604-9p7kplu1vd2cvcju) (version source revid:zhenxing.he@sun.com-20091026140226-uhnqejkyqx1aeilc) (merge vers: 6.0.14-alpha) (pib:13)
[27 Oct 2009 19:04] Jon Stephens 
Also documented in the 6.0.14 changelog.

Closed.
[12 Nov 2009 8:20] Bugs System 
Pushed into 5.5.0-beta (revid:alik@sun.com-20091110093229-0bh5hix780cyeicl) (version source revid:alik@sun.com-20091027095744-rf45u3x3q5d1f5y0) (merge vers: 5.5.0-beta) (pib:13)
[12 Nov 2009 14:24] Jon Stephens 
Also documented in the 5.5.0 changelog. Closed.