=== modified file 'mysql-test/r/sp-security.result' --- mysql-test/r/sp-security.result 2011-04-13 07:59:17 +0000 +++ mysql-test/r/sp-security.result 2014-03-13 13:14:46 +0000 @@ -617,3 +617,33 @@ SELECT 1 latin1 latin1_swedish_ci latin1 # Connection default DROP USER user2@localhost; DROP DATABASE db1; +# +# Test for bug#12602983 - User without privilege on routine can discover +# its existence by executing "select non_existing_func();" or by +# "call non_existing_proc()"; +# +drop database if exists mysqltest_db; +create database mysqltest_db; +create function mysqltest_db.f1() returns int return 0; +create procedure mysqltest_db.p1() begin end; +# Create user with no privileges on mysqltest_db database. +create user bug12602983_user@localhost; +# Connect as user 'bug12602983_user@localhost' +# Attempt to execute routine on which user doesn't have privileges +# should result in the same 'access denied' error whether +# routine exists or not. +select mysqltest_db.f_does_not_exist(); +ERROR 42000: execute command denied to user 'bug12602983_user'@'localhost' for routine 'mysqltest_db.f_does_not_exist' +call mysqltest_db.p_does_not_exist(); +ERROR 42000: execute command denied to user 'bug12602983_user'@'localhost' for routine 'mysqltest_db.p_does_not_exist' +select mysqltest_db.f1(); +ERROR 42000: execute command denied to user 'bug12602983_user'@'localhost' for routine 'mysqltest_db.f1' +call mysqltest_db.p1(); +ERROR 42000: execute command denied to user 'bug12602983_user'@'localhost' for routine 'mysqltest_db.p1' +create view bug12602983_v1 as select mysqltest_db.f_does_not_exist(); +ERROR 42000: execute command denied to user 'bug12602983_user'@'localhost' for routine 'mysqltest_db.f_does_not_exist' +create view bug12602983_v1 as select mysqltest_db.f1(); +ERROR 42000: execute command denied to user 'bug12602983_user'@'localhost' for routine 'mysqltest_db.f1' +# Connection 'default'. +drop user bug12602983_user@localhost; +drop database mysqltest_db; === modified file 'mysql-test/t/sp-security.test' --- mysql-test/t/sp-security.test 2011-04-13 07:59:17 +0000 +++ mysql-test/t/sp-security.test 2014-03-13 13:14:24 +0000 @@ -995,6 +995,47 @@ disconnect con2; DROP USER user2@localhost; DROP DATABASE db1; +--echo # +--echo # Test for bug#12602983 - User without privilege on routine can discover +--echo # its existence by executing "select non_existing_func();" or by +--echo # "call non_existing_proc()"; +--echo # +--disable_warnings +drop database if exists mysqltest_db; +--enable_warnings +create database mysqltest_db; +create function mysqltest_db.f1() returns int return 0; +create procedure mysqltest_db.p1() begin end; + +--echo # Create user with no privileges on mysqltest_db database. +create user bug12602983_user@localhost; + +--echo # Connect as user 'bug12602983_user@localhost' +connect (conn1, localhost, bug12602983_user,,); + +--echo # Attempt to execute routine on which user doesn't have privileges +--echo # should result in the same 'access denied' error whether +--echo # routine exists or not. +--error ER_PROCACCESS_DENIED_ERROR +select mysqltest_db.f_does_not_exist(); +--error ER_PROCACCESS_DENIED_ERROR +call mysqltest_db.p_does_not_exist(); + +--error ER_PROCACCESS_DENIED_ERROR +select mysqltest_db.f1(); +--error ER_PROCACCESS_DENIED_ERROR +call mysqltest_db.p1(); + +--error ER_PROCACCESS_DENIED_ERROR +create view bug12602983_v1 as select mysqltest_db.f_does_not_exist(); +--error ER_PROCACCESS_DENIED_ERROR +create view bug12602983_v1 as select mysqltest_db.f1(); + +--echo # Connection 'default'. +connection default; +disconnect conn1; +drop user bug12602983_user@localhost; +drop database mysqltest_db; # Wait till all disconnects are completed --source include/wait_until_count_sessions.inc