Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Won't Fix
-
10.5.23, 10.5.24
Description
Step to reproduce :
Create a new database:
CREATE DATABASE test_db; |
Create two tables with foreign keys (optional but it also shows that not only primary keys are not returned):
CREATE TABLE `client` ( |
`id` int(11) NOT NULL, |
`name` varchar(25) DEFAULT NULL, |
PRIMARY KEY (`id`) |
);
|
CREATE TABLE `order` ( |
`id` int(11) NOT NULL, |
`client_id` int(11) DEFAULT NULL, |
PRIMARY KEY (`id`), |
KEY `client_id` (`client_id`), |
CONSTRAINT `fk_order_client` FOREIGN KEY (`client_id`) REFERENCES `client` (`id`) |
);
|
Create a new user with no specific privileges:
CREATE USER test; |
Connect as user test and select table constraints:
SELECT * FROM INFORMATION_SCHEMA.TABLE_CONSTRAINTS where TABLE_SCHEMA = 'test_db'; |
Result:
CONSTRAINT_CATALOG | CONSTRAINT_SCHEMA | CONSTRAINT_NAME | TABLE_SCHEMA | TABLE_NAME | CONSTRAINT_TYPE |
def | test_db | PRIMARY | test_db | client | PRIMARY KEY |
def | test_db | PRIMARY | test_db | order | PRIMARY KEY |
def | test_db | fk_order_client | test_db | order | FOREIGN KEY |
Grant SELECT privilege on test_db table to the test user:
GRANT SELECT ON test_db.* to test; |
Select table constraints again:
SELECT * FROM INFORMATION_SCHEMA.TABLE_CONSTRAINTS where TABLE_SCHEMA = 'test_db'; |
Result:
Empty set (0.0007 sec) |
Additional informations
I have tested all privileges and my observations is that the user need at least one of this privileges on the table to get back a result set (or none at all):
ALTER, CREATE, DELETE, DROP, INDEX, INSERT, UPDATE, REFERENCES, TRIGGER, SHOW VIEW
Attachments
Issue Links
- relates to
-
MDEV-32500 Information schema leaks table names and structure to unauthorized users
- Closed