From a64c06d02c66f0cd591f7b00571b513cf376e024 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Torkel=20=C3=96degaard?= <torkel@grafana.com>
Date: Mon, 22 May 2017 13:53:38 +0200
Subject: [PATCH] mysql: add user permission notice mysql config view, closes
 #8359

---
 .../plugins/datasource/mysql/partials/config.html | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/public/app/plugins/datasource/mysql/partials/config.html b/public/app/plugins/datasource/mysql/partials/config.html
index 60ea72a1ba7..4bdbd923bad 100644
--- a/public/app/plugins/datasource/mysql/partials/config.html
+++ b/public/app/plugins/datasource/mysql/partials/config.html
@@ -2,7 +2,6 @@
 <h3 class="page-heading">MySQL Connection</h3>
 
 <div class="gf-form-group">
-
 	<div class="gf-form max-width-30">
 		<span class="gf-form-label width-7">Host</span>
 		<input type="text" class="gf-form-input" ng-model='ctrl.current.url' placeholder="" required></input>
@@ -25,3 +24,17 @@
 	</div>
 </div>
 
+<div class="gf-form-group">
+	<div class="grafana-info-box">
+		<h5>User Permission</h5>
+		<p>
+			The database user should only be granted SELECT permissions on the specified database & tables you want to query.
+			Grafana does not validate that queries are safe so queries can contain any SQL statement. For example, statements
+			like <code>USE otherdb;</code> and <code>DROP TABLE user;</code> would be executed. To protect against this we
+			<strong>Highly</strong> recommmend you create a specific MySQL user with restricted permissions.
+
+			Checkout the <a class="external-link" target="_blank" href="http://docs.grafana.org/features/datasources/mysql/">MySQL Data Source Docs</a> for more information.
+		</p>
+	</div>
+</div>
+