Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of tisdall@gmail.com designates
 209.85.215.52 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CALOE=zvseq--7c7KnVer2yPGB3v768BrAN5JGuDqEWhG0ph7-Q@mail.gmail.com>
References: 
 <CALOE=ztuooJ4sken5e3QZS1XGDFpGZ42eTLsp99gjP+isa2gLg@mail.gmail.com>
	<6AB18F55-7141-4D4F-9CCD-850B67EE1E53@apache.org>
	<CALOE=zvseq--7c7KnVer2yPGB3v768BrAN5JGuDqEWhG0ph7-Q@mail.gmail.com>
Date: Wed, 29 Aug 2012 16:25:54 -0400
Message-ID: 
 <CAGxYWpZLaVQQjtaMpbDkbqodc5raOknO-0FVbxk1rWUAPzCn7Q@mail.gmail.com>
Subject: Re: Possible validation security issue
From: Tim Tisdall <tisdall@gmail.com>
To: user@couchdb.apache.org
Content-Type: text/plain; charset=ISO-8859-1

I think it should probably be looking at the oldDoc like Paul said.
Then it should be preventing all editing unless the current user is
the one in the doc (including changing the author).

On the top of the couchdb definitive guide page you sent there's a
link that says "report issue"...  I'm pretty sure you found a problem
in the code.  I also didn't see an existing issue in the issue tracker
about it.

On Wed, Aug 29, 2012 at 3:01 PM, Wordit <wordituk@gmail.com> wrote:
> The function I used is from the "CouchDB Definitive Guide". It's in
> both the security and validation sections.
>
> http://guide.couchdb.org/draft/security.html
>
> "We had an update validation function that allowed us to verify that
> the claimed author of a document matched the authenticated username."
>
> Is the guide outdated, is it an error in the guide, or did I
> misunderstand what it is to be used for? Or all three perhaps?
>
>
> That aside, why does the function prevent updating all fields except
> the author field when that is the one in the validation function? What
> am I missing in couchdb's logic?
>
> Marcus