Description:
Unprivileged users (no SUPER priv) can run 'set timestamp = ...' to change their per-session clock. This determines the result for now(), sysdate() if sysdate_is_now is used and the value of 'set timestamp ...' written to the binlog.
I don't think a user without the SUPER privilege should be allowed to do this. And it makes it difficult to have faith in the value of the per-session clock. The current behavior makes it easy for some users to cheat and change their per-session clock when that helps them.
select now();
create table it(i int, ts timestamp);
insert into it values (1, now());
set timestamp = 1228771000;
insert into it values (2, now());
mysql> select * from it;
+------+---------------------+
| i | ts |
+------+---------------------+
| 1 | 2008-12-08 13:27:46 |
| 2 | 2008-12-08 13:16:40 |
+------+---------------------+
Also, you can make a query appear to have been running for a long time by:
set timestamp = <time from many minutes ago>;
<run query>
And then look at SHOW PROCESSLIST output
How to repeat:
above
Suggested fix:
Require SUPER for set timestamp
