[
https://issues.apache.org/jira/browse/COUCHDB-2534?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14265577#comment-14265577
]
ASF GitHub Bot commented on COUCHDB-2534:
-----------------------------------------
GitHub user kxepal opened a pull request:
https://github.com/apache/couchdb-couch/pull/29
2534 db security respect authed users
This does two things:
- Fixes the way how user name is searched in list. lists:member/2 made in
BIF, faster and doesn't causes redundant list copy;
- Fixes readers vs members terminology in code;
- Fixes COUCHDB-2534, throwing forbidden error if user is authenticated,
but is not a database member.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/kxepal/couchdb-couch
2534-db-security-respect-authed-users
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/couchdb-couch/pull/29.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #29
----
commit d3c7d13346f3f5af679970bb80374d7c8f0a5b67
Author: Alexander Shorin <[email protected]>
Date: 2015-01-06T02:12:39Z
Use lists:member/2 to check if user name is in list
commit 3300fca3a35c0d0075a79af6a5662ff9537bc5e3
Author: Alexander Shorin <[email protected]>
Date: 2015-01-06T02:16:05Z
Throw forbidden error if user is authenticated on db membership check
COUCHDB-2534
commit 7134d7ebd6d9d9c6586f37df9ef9aa2b6891b38a
Author: Alexander Shorin <[email protected]>
Date: 2015-01-06T02:19:32Z
Normalize terminology readers vs members
----
> Return forbidden error when authed user tries to access database it doesn't
> allowed
> -----------------------------------------------------------------------------------
>
> Key: COUCHDB-2534
> URL: https://issues.apache.org/jira/browse/COUCHDB-2534
> Project: CouchDB
> Issue Type: Bug
> Security Level: public(Regular issues)
> Components: Database Core
> Affects Versions: 2.0.0, 1.6.1
> Reporter: Alexander Shorin
> Assignee: Alexander Shorin
>
> This also cases annoying behaviour when `require_valid_user` set as `true`.
> Steps to reproduce:
> 1. Fix admin party
> 2. Create some user
> 3. Create some database
> 4. Setup members for those database excluding access for your user
> 5. Set `require_valid_user=true`
> 6. Login as the user and open up futon
> During databases list rendering Futon requests every database for the info
> about num of docs, db size etc. When it hits database which don't has a
> current user in members, CouchDB returns 401 unauthorized error, even if you
> are. This error comes to httpd error handler and according
> `require_valid_user` setting CouchDB send WWW-Authenticate header in response
> back to browser - this happens only for unauthorized errors. Browser sees
> that header and shows modal dialog to let end-user specify credentials in
> order to access some unnamed resource. And so happens for every database.
> If you have hundred ones and user has access only to some single one using
> futon/fauxton turns into nightmare.
> The error origin from couch_db:check_is_member/1 which doesn't care about if
> user is already auth'ed counting everyone as not in case if they are not
> members.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
