Bug #15895 user without permisions can create databases

• Submitted: 21 Dec 2005 0:11
• Modified: 21 Dec 2005 20:03
• Reporter: Peter Pentel
• Status: Can't repeat
• Category: MySQL Server
• Severity: S2 (Serious)
• Version: MySQL 4.1.15
• OS: Linux (FEDORA C4)
• Assigned to: MySQL Verification Team
• CPU Architecture: Any

[21 Dec 2005 0:11] Peter Pentel

Description:
If i have a database with "_" and a user with only permisions over this database, they (the user) can create a database with the "_" replaced by an "?".

How to repeat:
if i have a mysql fresh instalaction, i do:

mysql> create database something_db01;
Query OK, 1 row affected (0.00 sec)

mysql> grant All on something_db01  to someuser@localhost identified by '34lkxc2d';

mysql> quit

# mysql -u someuser -p
password:
mysql> create database `something?db01`;
Query OK, 1 row affected (0.00 sec)

mysql> show databases;
+--------------+
| Database     |
+--------------+
| something?db01 |
| something_db01 |
| mysql        |
| system       |
| test         |
+--------------+

mysql> quit

if i try to create another database ie: something?db0, something?d0 or other than subs "_" for an "?" dont work.

[21 Dec 2005 1:35] MySQL Verification Team

I was unable to repeat with current source server:

miguel@hegel:~/dbs/4.1> bin/mysql -uroot
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1 to server version: 4.1.17-debug-log

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> create database something_db01;
Query OK, 1 row affected (0.01 sec)

mysql> use something_db01;
Database changed
mysql>  grant All on something_db01  to someuser@localhost identified by
    -> '34lkxc2d';
Query OK, 0 rows affected (0.00 sec)

mysql> exit
Bye
miguel@hegel:~/dbs/4.1> bin/mysql -usomeuser -p
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2 to server version: 4.1.17-debug-log

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> create database `something?db01`;
ERROR 1044 (42000): Access denied for user 'someuser'@'localhost' to database 'something?db01'
mysql>

[21 Dec 2005 20:03] Peter Pentel

this happend to my. Some idea?