MySQL Bugs: #31673: SUPER privilege no more needed for SHOW TRIGGERS etc.

Bug #31673	SUPER privilege no more needed for SHOW TRIGGERS etc.
Submitted:	17 Oct 2007 20:03	Modified:	27 Nov 2007 20:17
Reporter:	Matthias Leich	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Documentation	Severity:	S3 (Non-critical)
Version:	5.1	OS:	Any
Assigned to:	Paul DuBois	CPU Architecture:	Any

Description:
The manual mentions within
dev.mysql.com/doc/refman/5.1/en/show-triggers.html
12.5.4.30. SHOW TRIGGERS Syntax
...
SHOW TRIGGERS lists the triggers currently defined
on the MySQL server.
This statement requires the SUPER privilege.

dev.mysql.com/doc/refman/5.1/en/triggers-table.html
23.16. The INFORMATION_SCHEMA TRIGGERS Table
...
You must have the SUPER privilege to access this table.

Reality on
mysql-5.1-build last ChangeSet@1.2579, 2007-10-15
revealed with the test myisam_trig_03e
-------------------------------------------------
1. USER has TRIGGER privilege, no SUPER privilege
   + creates a TRIGGER
2. SHOW TRIGGERS and SELECT * FROM 
   INFORMATION_SCHEMA.TRIGGERS
   show the trigger created by the user
3. USER looses the TRIGGER privilege
4. SHOW TRIGGERS and SELECT * FROM 
   INFORMATION_SCHEMA.TRIGGERS
   show an empty result set

I guess the current server behaviour is intended
and the manual should be corrected.

How to repeat:
Please have a look at the corresponding manual
pages and
1. Build a MySQL release.
2. cd mysql-test
3. ./mysql-test-run.pl --mem --suite=funcs_1 \
   --force --do-test=myisam_trig_03e
4. You will probably see the effects of
   Bug#31408 funcs_1: <engine>_trig_03e test fail
   The "reject" file shows the effects mentioned
   within the description above.

Paul, this is intentional:
Bug #27629  	Possible security flaw in INFORMATION_SCHEMA and SHOW statements

Thank you for your bug report. This issue has been addressed in the documentation. The updated documentation will appear on our website shortly, and will be included in the next release of the relevant products.

SHOW TRIGGERS and the INFORMATION_SCHEMA.TRIGGERS table require the TRIGGER (not SUPER) privilege as of MySQL 5.1.22.

Actually 5.1.23, not 5.1.22.