[
https://issues.apache.org/jira/browse/COUCHDB-1656?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13564136#comment-13564136
]
Jason Smith commented on COUCHDB-1656:
--------------------------------------
By the way, if you say that an empty members list, [] should mean *nobody* has
access rather than *everybody* has access, then yes--GOD YES--I agree with you.
However that would break the API and so that must wait until after the 1.x
series.
> Anonymous Users and Non-Admins Can Read the Security Object
> -----------------------------------------------------------
>
> Key: COUCHDB-1656
> URL: https://issues.apache.org/jira/browse/COUCHDB-1656
> Project: CouchDB
> Issue Type: Bug
> Components: Database Core
> Reporter: Klaus Trainer
> Attachments:
> 0001-Don-t-give-non-admins-read-access-to-db-_security.patch
>
>
> It is possible that anonymous users are able to read a DB's security object
> if the security object's `members` array is empty or missing. Also, it is
> generally possible for authenticated members (non-admin users) to read the
> security object.
> Only admin users should be allowed to read the security object.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
