MySQL Bugs: #9505: Views: privilege needed on underlying function

Bug #9505	Views: privilege needed on underlying function
Submitted:	31 Mar 2005 0:32	Modified:	31 Oct 2005 19:28
Reporter:	Peter Gulutzan	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server	Severity:	S3 (Non-critical)
Version:	5.0.4-beta-debug	OS:	Linux (SUSE 9.2)
Assigned to:	Oleksandr Byelkin	CPU Architecture:	Any

Description:
If I have SELECT privilege on a view, I should not need EXECUTE privilege on the view's underlying function(s). But I do.

This bug will be easier to reproduce after bug#8137 is fixed.

How to repeat:
As user root, say:

mysql> delimiter //
mysql> create database db36//
Query OK, 1 row affected (0.00 sec)

mysql> use db36//
Database changed

mysql> create table t1 (s1 int)//
Query OK, 0 rows affected (0.01 sec)

mysql> grant select on t1 to user21@localhost//
Query OK, 0 rows affected (0.00 sec)

As user user21@localhost (on another shell and another copy of mysql client), say:

mysql> use db36;
Reading table information for completion of table and column names ...

As user root, say:

mysql> create table t2 (s1 int)//
Query OK, 0 rows affected (0.00 sec)

mysql> create function f2 () returns int begin declare v int; select s1 from t2 into v; return v; end//
Query OK, 0 rows affected (0.00 sec)

mysql> create view v2 as select f2()//
Query OK, 0 rows affected (0.00 sec)

mysql> grant select on v2 to user21@localhost//
Query OK, 0 rows affected (0.00 sec)

As user user21@localhost, say:

mysql> select * from v2;
ERROR 1370 (42000): execute command denied to user 'user21'@'localhost' for routine 'db36.f2'

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/internals/26580

Basic patch is ok, but the following needs yet to be done:
- Check during view create time that the creator of the view has right to execute the functions
- Add tests that shows that one can't create a view with a function that one doesn't have execute permission to
Same goes for prepared statements:
- Add example of preparation in PS statement with SP on which you have not rights

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/internals/30026

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/internals/31583

Thank you for bugreport!
Bugfix pushed to the 5.0.16 tree

Noted in 5.0.16 changelog.