Bug #13821 Stored procedures: wrong USER() value

Submitted: 6 Oct 2005 21:12 Modified: 17 Dec 2005 15:47
Reporter: Peter Gulutzan Email Updates:
Status: No Feedback Impact on me:
None 
Category:MySQL Server: Stored Routines Severity:S3 (Non-critical)
Version:5.0.15-rc-debug OS:Linux (SUSE 9.2)
Assigned to: Assigned Account CPU Architecture:Any

[6 Oct 2005 21:12] Peter Gulutzan
Description:
This is related to bug#7291 "Stored procedures: wrong CURRENT_USER value"
which was fixed and closed.

I complained in bug#7291 that, for a
"SQL SECURITY DEFINER" procedure, SELECT CURRENT_USER
should show the definer, not the caller. OleksandrByelkin fixed it.
But USER() still has the caller. For example:

As root@localhost, I say:
create procedure pn7 ()
 sql security definer
 select user(),session_user(),current_user;
mysql> grant execute on pn7 to jb@localhost;
 
As jb@localhost, I say:
call pn7();

The answer I get is:
mysql> call pn7();
+--------------+----------------+----------------+
| user()       | session_user() | current_user   |
+--------------+----------------+----------------+
| jb@localhost | jb@localhost   | root@localhost |
+--------------+----------------+----------------+
1 row in set (0.00 sec)

I agree that session_user() is correct.

I agree that current_user is correct.

I disagree about user(). I think it should be the
same as current_user, because the standard says
"user" and "current_user" are pretty well the same.

How to repeat:
As root@localhost, say:
create procedure pn7 ()
 sql security definer
 select user(),session_user(),current_user;
mysql> grant execute on pn7 to jb@localhost;

As jb@localhost, say:
call pn7()
[7 Oct 2005 0:32] MySQL Verification Team
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 7 to server version: 5.0.15-rc-debug

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> delimiter //
mysql> create procedure pn7 ()
    ->  sql security definer
    ->  select user(),session_user(),current_user;
    -> //
Query OK, 0 rows affected (0.01 sec)

mysql> grant execute on procedure pn7 to jb@localhost//
Query OK, 0 rows affected (0.01 sec)

miguel@hegel:~/dbs/5.0> bin/mysql -ujb test
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 9 to server version: 5.0.15-rc-debug

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> call pn7();
+--------------+----------------+----------------+
| user()       | session_user() | current_user   |
+--------------+----------------+----------------+
| jb@localhost | jb@localhost   | root@localhost |
+--------------+----------------+----------------+
1 row in set (0.00 sec)

Query OK, 0 rows affected (0.00 sec)
[18 Dec 2005 0:00] Bugs System
No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".

Portions of this website are copyright © 2001, 2002 The PHP Group

Page generated in 0.052 sec. using MySQL 8.4.7-u6-cloud

Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the respective copyright holders.
It is not reviewed in advance by Oracle and does not necessarily represent the opinion of Oracle or any other party.