[MDEV-30484] user@ip can query tables where user@'%' can access to. Created: 2023-01-27 Updated: 2023-02-10 Resolved: 2023-01-27 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Authentication and Privilege System |
| Affects Version/s: | 10.3, 10.4, 10.5, 10.6 |
| Fix Version/s: | N/A |
| Type: | Bug | Priority: | Major |
| Reporter: | Richard Stracke | Assignee: | Sergei Golubchik |
| Resolution: | Not a Bug | Votes: | 0 |
| Labels: | None | ||
| Description |
|
So user mtest@'x.x.x.x' can access to table sbtest.sbtest1 where
|
| Comments |
| Comment by Sergei Golubchik [ 2023-01-27 ] |
|
This works as designed, it's not a bug. It's a bit counterintuitive nowadays, but it's how it always worked for the last 30 years and such behavior is very difficult to change. When you access the table, the server searches tables_priv table. It find a matching row with table_name="sbtest1" and user="sbtest" and host="%" (which matches any host). Thus, the access is granted. |