|
Unauthorized access to the sequence
|
create database db;
|
use db;
|
create sequence s;
|
create sql security invoker view v as select nextval(s);
|
create user u@localhost;
|
grant select on db.v to u@localhost;
|
|
--connect (con1,localhost,u,,db)
|
--error ER_TABLEACCESS_DENIED_ERROR
|
select nextval(s);
|
--error ER_VIEW_INVALID
|
select * from v;
|
|
--disconnect con1
|
--connection default
|
drop database db;
|
drop user u@localhost;
|
The expected result would be (as coded in the test case) that SELECT from the view fails with "View 'db.v' references invalid table(s) or column(s) or function(s) or definer/invoker of view lack rights to use them" or some kind of access denied error; instead, it succeeds;
|
main ab468e33aff110b44a31ce0350894906ff4bc757
|
mysqltest: At line 12: query 'select * from v' succeeded - should have failed with error ER_VIEW_INVALID (1356)...
|
If we use a stored function instead of a sequence in an otherwise identical test case, it works as expected – SELECT from the view fails:
|
OK with a function instead of a sequence
|
create database db;
|
use db;
|
create function f() returns int return 1;
|
create sql security invoker view v as select f();
|
create user u@localhost;
|
grant select on db.v to u@localhost;
|
|
--connect (con1,localhost,u,,db)
|
--error ER_PROCACCESS_DENIED_ERROR
|
select f();
|
--error ER_VIEW_INVALID
|
select * from v;
|
|
--disconnect con1
|
--connection default
|
drop database db;
|
drop user u@localhost;
|
Bug
Blocker
