incubator-couchdb-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Brian Candler <B.Cand...@pobox.com>
Subject Re: DB ACLs (was Re: 0.11 Release / Feature Freeze for 1.0)
Date Tue, 09 Feb 2010 19:30:37 GMT
On Tue, Feb 09, 2010 at 09:04:49AM -0800, Chris Anderson wrote:
> If you do a get against /_session does it show you as an admin?

Yes (see below)

> couch_db:check_is_admin() should allow access in this case.
> 
> If you can reliably reproduce this, I'd like to fix it.

Yes, I can reliably reproduce. Here is a brand new installation of trunk,
still in admin party mode:

$ curl -X PUT http://127.0.0.1:5984/zzz
{"ok":true}
$ curl -X PUT -d '{"names":["foo"]}'
http://127.0.0.1:5984/zzz/_readers
{"ok":true}
$ curl -X POST -d '{"map":"function(){}"}' http://127.0.0.1:5984/zzz/_temp_view
{"error":"unauthorized","reason":"You are not authorized to access this db."}
$ curl http://127.0.0.1:5984/
{"couchdb":"Welcome","version":"0.11.0bcc31819f-git"}
$ curl http://127.0.0.1:5984/_session
{"ok":true,"userCtx":{"name":null,"roles":["_admin"]},"info":{"authentication_db":"_users","authentication_handlers":["oauth","cookie","default"],"authenticated":"default"}}

Regards,

Brian.

Mime
View raw message