You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We've noticed that when a user doesn't exist on a mysql database, when grantinee is run, it will create the user without a password and assign the permissions to it, despite error messages that "no user exists".
To reproduce:
have no user in the database
set permissions for the nonexistent user
run grantinee
look in the database: select user, host, authentication_string, password_last_changed from mysql.user;
You should see the previously non-existent user with an empty authentication_string value. If you run SHOW GRANTS FOR 'non_existent_user'@'host' then it will have all permissions defined by the Grantinee file.
Note: this was observed on a Grantinee client when running the dsl, engine and executor directly instead of through the CLI. Perhaps the user creation is prevented in the CLI class
The text was updated successfully, but these errors were encountered:
We've noticed that when a user doesn't exist on a mysql database, when grantinee is run, it will create the user without a password and assign the permissions to it, despite error messages that "no user exists".
To reproduce:
select user, host, authentication_string, password_last_changed from mysql.user;
You should see the previously non-existent user with an empty
authentication_string
value. If you runSHOW GRANTS FOR 'non_existent_user'@'host'
then it will have all permissions defined by the Grantinee file.Note: this was observed on a Grantinee client when running the dsl, engine and executor directly instead of through the CLI. Perhaps the user creation is prevented in the CLI class
The text was updated successfully, but these errors were encountered: