Bug #4777 Views: SHOW CREATE VIEW is possible with no view privilege
Submitted: 27 Jul 2004 22:14 Modified: 18 Sep 2004 7:52
Reporter: Peter Gulutzan Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server Severity:S3 (Non-critical)
Version:5.0.1-alpha-debug OS:Linux (SuSE 8.2)
Assigned to: Oleksandr Byelkin CPU Architecture:Any

[27 Jul 2004 22:14] Peter Gulutzan 
Description:
I should not be able to see a view description if I don't have SHOW CREATE VIEW 
privilege. But if view v is based on table t, "SHOW CREATE VIEW v" succeeds 
if I have a privilege on t, even though I have no privilege on v. 

How to repeat:
As user root, say: 
 
mysql> create table tx (s1 int); 
Query OK, 0 rows affected (0.29 sec) 
 
mysql> create view vx as select * from tx; 
Query OK, 0 rows affected (0.00 sec) 
 
As user peter, say: 
 
mysql> show create view vx; 
 
You'll get the error: 
ERROR 1344 (HY000): EXPLAIN/SHOW can not be issued; lacking privileges for 
underlying table 
 
As user root, say: 
 
mysql> grant select on tx to peter; 
Query OK, 0 rows affected (0.00 sec) 
 
As user peter, say: 
 
show create view vx; 
 
The SHOW will succeed.
[17 Sep 2004 19:31] Oleksandr Byelkin 
ChangeSet 
  1.1684 04/09/17 22:23:59 bell@sanja.is.com.ua +4 -0 
  SHOW CREATE VIEW (TABLE) privilege now reqiere show create privilege 
  (BUG#4777)
[18 Sep 2004 7:52] Oleksandr Byelkin 
Thank you for bugreport, bugfix is pushed into source repository.