Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of wordituk@gmail.com designates
 209.85.210.180 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <6AB18F55-7141-4D4F-9CCD-850B67EE1E53@apache.org>
References: 
 <CALOE=ztuooJ4sken5e3QZS1XGDFpGZ42eTLsp99gjP+isa2gLg@mail.gmail.com>
 <6AB18F55-7141-4D4F-9CCD-850B67EE1E53@apache.org>
From: Wordit <wordituk@gmail.com>
Date: Wed, 29 Aug 2012 21:01:48 +0200
Message-ID: 
 <CALOE=zvseq--7c7KnVer2yPGB3v768BrAN5JGuDqEWhG0ph7-Q@mail.gmail.com>
Subject: Re: Possible validation security issue
To: user@couchdb.apache.org
Content-Type: text/plain; charset=UTF-8

The function I used is from the "CouchDB Definitive Guide". It's in
both the security and validation sections.

http://guide.couchdb.org/draft/security.html

"We had an update validation function that allowed us to verify that
the claimed author of a document matched the authenticated username."

Is the guide outdated, is it an error in the guide, or did I
misunderstand what it is to be used for? Or all three perhaps?


That aside, why does the function prevent updating all fields except
the author field when that is the one in the validation function? What
am I missing in couchdb's logic?

Marcus