couchdb-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (JIRA)" <>
Subject [jira] [Commented] (COUCHDB-2534) Return forbidden error when authed user tries to access database it doesn't allowed
Date Tue, 06 Jan 2015 02:28:34 GMT


ASF GitHub Bot commented on COUCHDB-2534:

GitHub user kxepal opened a pull request:

    2534 db security respect authed users

    This does two things:
    - Fixes the way how user name is searched in list. lists:member/2 made in BIF, faster
and doesn't causes redundant list copy;
    - Fixes readers vs members terminology in code;
    - Fixes COUCHDB-2534, throwing forbidden error if user is authenticated, but is not a
database member.

You can merge this pull request into a Git repository by running:

    $ git pull 2534-db-security-respect-authed-users

Alternatively you can review and apply these changes as the patch at:

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #29
commit d3c7d13346f3f5af679970bb80374d7c8f0a5b67
Author: Alexander Shorin <>
Date:   2015-01-06T02:12:39Z

    Use lists:member/2 to check if user name is in list

commit 3300fca3a35c0d0075a79af6a5662ff9537bc5e3
Author: Alexander Shorin <>
Date:   2015-01-06T02:16:05Z

    Throw forbidden error if user is authenticated on db membership check

commit 7134d7ebd6d9d9c6586f37df9ef9aa2b6891b38a
Author: Alexander Shorin <>
Date:   2015-01-06T02:19:32Z

    Normalize terminology readers vs members


> Return forbidden error when authed user tries to access database it doesn't allowed
> -----------------------------------------------------------------------------------
>                 Key: COUCHDB-2534
>                 URL:
>             Project: CouchDB
>          Issue Type: Bug
>      Security Level: public(Regular issues) 
>          Components: Database Core
>    Affects Versions: 2.0.0, 1.6.1
>            Reporter: Alexander Shorin
>            Assignee: Alexander Shorin
> This also cases annoying behaviour when `require_valid_user` set as `true`. Steps to
> 1. Fix admin party
> 2. Create some user
> 3. Create some database
> 4. Setup members for those database excluding access for your user
> 5. Set `require_valid_user=true`
> 6. Login as the user and open up futon
> During databases list rendering Futon requests every database for the info about num
of docs, db size etc. When it hits database which don't has a current user in members, CouchDB
returns 401 unauthorized error, even if you are. This error comes to httpd error handler and
according `require_valid_user` setting CouchDB send WWW-Authenticate header in response back
to browser - this happens only for unauthorized errors. Browser sees that header and shows
modal dialog to let end-user specify credentials in order to access some unnamed resource.
And so happens for every database. 
> If you have hundred ones and user has access only to some single one using futon/fauxton
turns into nightmare.
> The error origin from couch_db:check_is_member/1 which doesn't care about if user is
already auth'ed counting everyone as not in case if they are not members.

This message was sent by Atlassian JIRA

View raw message