Privilege check is skipped for PREPARE statement

[djshow832]

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. Minimal reproduce step (Required)

The root creates a user with no privileges:

mysql> CREATE USER 'u1'@'localhost';
Query OK, 0 rows affected (0.02 sec)

mysql> create table test.t1(id int);
Query OK, 0 rows affected (0.01 sec)

Login with u1:

mysql -h127.1 -uu1 -P7000
mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| INFORMATION_SCHEMA |
+--------------------+
1 row in set (0.01 sec)

mysql> prepare stmt from 'select * from test.t1';
Query OK, 0 rows affected (0.00 sec)

mysql> prepare stmt from 'select * from test.t1 where id=1';
Query OK, 0 rows affected (0.00 sec)

mysql> prepare stmt from 'select * from test.t1 where x=1';
ERROR 1054 (42S22): Unknown column 'x' in 'where clause'

2. What did you expect to see? (Required)

mysql> prepare stmt from 'select * from test.t1';
ERROR 1142 (42000): SELECT command denied to user 'u1'@'localhost' for table 't1'

3. What did you see instead (Required)

mysql> prepare stmt from 'select * from test.t1';
Query OK, 0 rows affected (0.00 sec)

mysql> prepare stmt from 'select * from test.t1 where id=1';
Query OK, 0 rows affected (0.00 sec)

mysql> prepare stmt from 'select * from test.t1 where x=1';
ERROR 1054 (42S22): Unknown column 'x' in 'where clause'

Although u1 cannot see the data, he can inspect the table definition through the PREPARE statement. E.g. he knows that the table test.t1 exists, and test.t1 has column id but no x.

4. What is your TiDB version? (Required)

master