MySQL Bugs: #13821: Stored procedures: wrong USER() value

Bug #13821	Stored procedures: wrong USER() value
Submitted:	6 Oct 2005 21:12	Modified:	17 Dec 2005 15:47
Reporter:	Peter Gulutzan	Email Updates:
Status:	No Feedback	Impact on me:	None
Category:	MySQL Server: Stored Routines	Severity:	S3 (Non-critical)
Version:	5.0.15-rc-debug	OS:	Linux (SUSE 9.2)
Assigned to:	Assigned Account	CPU Architecture:	Any

Description:
This is related to bug#7291 "Stored procedures: wrong CURRENT_USER value"
which was fixed and closed.

I complained in bug#7291 that, for a
"SQL SECURITY DEFINER" procedure, SELECT CURRENT_USER
should show the definer, not the caller. OleksandrByelkin fixed it.
But USER() still has the caller. For example:

As root@localhost, I say:
create procedure pn7 ()
 sql security definer
 select user(),session_user(),current_user;
mysql> grant execute on pn7 to jb@localhost;
 
As jb@localhost, I say:
call pn7();

The answer I get is:
mysql> call pn7();
+--------------+----------------+----------------+
| user()       | session_user() | current_user   |
+--------------+----------------+----------------+
| jb@localhost | jb@localhost   | root@localhost |
+--------------+----------------+----------------+
1 row in set (0.00 sec)

I agree that session_user() is correct.

I agree that current_user is correct.

I disagree about user(). I think it should be the
same as current_user, because the standard says
"user" and "current_user" are pretty well the same.

How to repeat:
As root@localhost, say:
create procedure pn7 ()
 sql security definer
 select user(),session_user(),current_user;
mysql> grant execute on pn7 to jb@localhost;

As jb@localhost, say:
call pn7()

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 7 to server version: 5.0.15-rc-debug

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> delimiter //
mysql> create procedure pn7 ()
    ->  sql security definer
    ->  select user(),session_user(),current_user;
    -> //
Query OK, 0 rows affected (0.01 sec)

mysql> grant execute on procedure pn7 to jb@localhost//
Query OK, 0 rows affected (0.01 sec)

miguel@hegel:~/dbs/5.0> bin/mysql -ujb test
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 9 to server version: 5.0.15-rc-debug

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> call pn7();
+--------------+----------------+----------------+
| user()       | session_user() | current_user   |
+--------------+----------------+----------------+
| jb@localhost | jb@localhost   | root@localhost |
+--------------+----------------+----------------+
1 row in set (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".