2 messages in com.mysql.lists.bugsGrant table insert bug| From | Sent On | Attachments |
|---|---|---|
| Brian Hacking | 09 May 2000 00:41 | |
| Michael Widenius | 09 May 2000 04:30 |
| Subject: | Grant table insert bug![]() |
|---|---|
| From: | Brian Hacking (bri...@intraforms.com) |
| Date: | 05/09/2000 12:41:31 AM |
| List: | com.mysql.lists.bugs |
NT 4.0 - service pack 6 Pentium 400/128 megs of RAM mySQL 3.22.34 for win95/98
typical installation mysqld-nt -install (restart computer)
mysql delete from mysql.user where user=''; create database test; create table db.table(name char(40)); grant usage on db.* to test; grant insert on db.table to test; select from mysql.user; select from mysql.db; select from mysql.tables_priv; quit mysql -u test status insert into db.table values('test'); select * from db.table; delete from db.table where name='test'; select * from db.table; quit
The first three selects look ok. The status shows user test. The next select shows the user (which I shouldn't have rights to see). The delete returns one column changed (which I shouldn't have rights to do). The last select shows an empty table;
I was having troubles with 3.22.33 not letting me insert a user given this scenario. I moved to 3.22.34 and now have too many privileges and can reproduce it from the command line sequence shown above. Some of the lines are unnecessary but I wanted to verify what was happening along the way...




