Crazy mysql

[santafehosting]

If you create the data base whith the following scheme:

DATABASE NAME: username_dbname
USER NAME: username_xxxx
PASSW: yyyyyyyy

and you allow the username_xxxx to do everything on username_dbname you are
also giving the permissions to any db that has the following scheme
username?dbname
the "?" means any character for db names


Online doc:
http://dev.mysql.com/doc/mysql/en/GRANT.html

look into this paragraph to have an idea of what im talking about:

Note: the `_' and `%' wildcards are allowed when specifying database
names in GRANT statements that grant privileges at the global or
database levels. This means, for example, that if you want to use a `_'
character as part of a database name, you should specify it as `\_' in
the GRANT statement, to prevent the user from being able to access
additional databases matching the wildcard pattern; for example, GRANT
... ON `foo\_bar`.* TO ....

 

[jmstacey]

Another problem is that users can add new databases through the command line or even phpmyadmin now. It would be nice if DA ran a check along with the nightly tally for stray databases and notify the administrator.

 

[DirectAdmin Support]

Hello,

That was fixed in DA as of 1.23.0, but it doesn't change existing databases, it only affects newly created ones.

John