janl commented on a change in pull request #1440: Optionally prevent non-admins
from accessing /_all_dbs
URL: https://github.com/apache/couchdb/pull/1440#discussion_r202533620
##########
File path: src/chttpd/src/chttpd_auth_request.erl
##########
@@ -34,7 +34,11 @@ authorize_request_int(#httpd{path_parts=[]}=Req) ->
authorize_request_int(#httpd{path_parts=[<<"favicon.ico">>|_]}=Req) ->
Req;
authorize_request_int(#httpd{path_parts=[<<"_all_dbs">>|_]}=Req) ->
- Req;
+ case config:get("chttpd", "admin_only_all_dbs", "false") of
+ "false" -> Req;
+ "true" -> require_admin(Req);
+ Else -> couch_log:error("Invalid setting for admin_only_all_dbs: ~p.
Must be true or false.", [Else])
Review comment:
@rnewson sorry for making my intentions not clear enough. I’d like to avoid
people leaving `_all_dbs` open when they think they’ve closed it due to a
config typo like `admin_only_all_dbs = True`.
So in my first attempt I’m allowing non-admin access is the config value is
explicitly `"true"`, and require admin access at all other times.
In my second attempt, I matched `"true"` and `"false"`, but that would lead
to a bad match, if the config value had a typo, so I wanted at least to leave a
nice error message.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
