Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
11.8.5
-
Notable changes
-
Description
The observed behaviour appears to contradict the documentation here:
The documentation states:
Once connected, you only have the privileges granted to the account that matched, not all accounts that could have matched. For example, consider the following commands:
CREATE USER 'joffrey'@'192.168.0.3';
|
CREATE USER 'joffrey'@'%';
|
GRANT SELECT ON test.t1 TO 'joffrey'@'192.168.0.3';
|
GRANT SELECT ON test.t2 TO 'joffrey'@'%';
|
If you connect as joffrey from 192.168.0.3, you will have the SELECT privilege on the table test.t1 but not on the table test.t2. If you connect as joffrey from any other IP address, you will have the SELECT privilege on the table test.t2, but not on the table test.t1
However, in my testing, the user is able to query test.t2 successfully.
CREATE USER 'joffrey'@'192.168.1.5' IDENTIFIED BY 'x';
|
CREATE USER 'joffrey'@'%' IDENTIFIED BY 'y';
|
GRANT SELECT ON test.t1 TO 'joffrey'@'192.168.1.5';
|
GRANT SELECT ON test.t2 TO 'joffrey'@'%';
|
After login with 'joffrey'@'192.168.1.5'
mariadb --protocol=TCP -ujoffrey -h192.168.1.5 -px |
MariaDB [(none)]> SHOW GRANTS FOR CURRENT_USER;
|
+------------------------------------------------------------------------------------------------------------------+
|
| Grants for joffrey@192.168.1.5 | |
+------------------------------------------------------------------------------------------------------------------+
|
| GRANT USAGE ON *.* TO `joffrey`@`192.168.1.5` IDENTIFIED BY PASSWORD '*B69027D44F6E5EDC07F1AEAD1477967B16F28227' | |
| GRANT SELECT ON `test`.`t1` TO `joffrey`@`192.168.1.5` | |
+------------------------------------------------------------------------------------------------------------------+
|
2 rows in set (0.000 sec) |
Despite the above grants, the following query succeeds:
MariaDB [(none)]> SELECT * FROM test.t2;
|
+-----+------+
|
| tid | name |
|
+-----+------+
|
| 1 | aa | |
+-----+------+
|
1 row in set (0.000 sec) |
Attachments
Issue Links
- has action item
-
DOCS-6420 Loading...
