MySQL Forums
Forum List  »  Security

Views and privileges
Posted by: David Deltek
Date: October 21, 2011 12:45PM

Hi all,

I have 3 databases:
ClientA
ClientB
StaticData

The database ClientA and ClientB have the same structure but different data
The database StaticData have data that does change

Example:
Clients databases have a table Employes and in it there is a column CityID. In the databse StaticData I have a table Cities that have CityID and CityName.

In the ClientA database I have created a view :
SELECT ClientA.Employes.*, StaticData.Cities.* FROM ClientA.Employes Join StaticData.Cities ON (ClientA.Employes.CityID = StaticData.Cities.CityID);
When I have copied it to ClientB I forgot to change the reference to ClientA for ClientB. So when I used the view in ClientB it give me the data of ClientA.

Easy fix I changed the view to use ClientB.

BUT my problem is that to connect to mysql server I have userA that have access to the databases ClientA and StaticData and I have a userB that have access to the databases ClientB and StaticData. No error/ warning that said userB is using a view that is accessing a database that he doesn't have any privileges.

Is it a bug, a security problem in mySQL or is it the way I created the users??

Here's the way I created the users using Webmin:
1 - Created a user with no permission
2 - Created database permission for the user for it database
3 - Created database permission for the user for StaticDatab

Thanks

Options: ReplyQuote


Subject
Views
Written By
Posted
Views and privileges
3398
October 21, 2011 12:45PM


Sorry, you can't reply to this topic. It has been closed.

Content reproduced on this site is the property of the respective copyright holders. It is not reviewed in advance by Oracle and does not necessarily represent the opinion of Oracle or any other party.