Bug #610 HANDLER permissions are not checked right for aliases
Submitted: 6 Jun 2003 7:39 Modified: 12 Jun 2003 8:38
Reporter: Peter Zaitsev (Basic Quality Contributor) Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server Severity:S2 (Serious)
Version:4.0 OS:Any (all)
Assigned to: Sergei Golubchik CPU Architecture:Any

[6 Jun 2003 7:39] Peter Zaitsev
Description:
There is the problem checking permissions in HANDLER function,
if table is opened as some alias.

Test2 is used here as we have by default every user allowed to do everything he wants with "test" database.

How to repeat:
create database test2;
use test2;

mysql> CREATE TABLE foo (code SMALLINT NOT NULL PRIMARY KEY);
Query OK, 0 rows affected (0.01 sec)

mysql> INSERT INTO foo VALUES (1),(2),(10);
Query OK, 3 rows affected (0.01 sec)
Records: 3  Duplicates: 0  Warnings: 0

mysql> GRANT SELECT ON test2.foo TO trouble@localhost IDENTIFIED BY 'trouble';
Query OK, 0 rows affected (0.01 sec)
mysql> quit

shell> mysql test2 -A -u trouble -ptrouble
mysql> HANDLER foo OPEN as foo1;
Query OK, 0 rows affected (0.00 sec)

mysql> HANDLER foo1 READ FIRST;
ERROR 1142: select command denied to user: 'trouble@localhost' for table 'foo1'
[12 Jun 2003 8:38] Sergei Golubchik
Thank you for your bug report. This issue has already been fixed
in the latest released version of that product, which you can download at 
http://www.mysql.com/downloads/