Uploaded image for project: 'CouchDB'
  1. CouchDB
  2. COUCHDB-2534

Return forbidden error when authed user tries to access database it doesn't allowed

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 2.0.0, 1.6.1
    • Fix Version/s: 2.0.0
    • Component/s: Database Core
    • Labels:
      None

      Description

      This also cases annoying behaviour when `require_valid_user` set as `true`. Steps to reproduce:
      1. Fix admin party
      2. Create some user
      3. Create some database
      4. Setup members for those database excluding access for your user
      5. Set `require_valid_user=true`
      6. Login as the user and open up futon

      During databases list rendering Futon requests every database for the info about num of docs, db size etc. When it hits database which don't has a current user in members, CouchDB returns 401 unauthorized error, even if you are. This error comes to httpd error handler and according `require_valid_user` setting CouchDB send WWW-Authenticate header in response back to browser - this happens only for unauthorized errors. Browser sees that header and shows modal dialog to let end-user specify credentials in order to access some unnamed resource. And so happens for every database.

      If you have hundred ones and user has access only to some single one using futon/fauxton turns into nightmare.

      The error origin from couch_db:check_is_member/1 which doesn't care about if user is already auth'ed counting everyone as not in case if they are not members.

        Activity

        Hide
        githubbot ASF GitHub Bot added a comment -

        GitHub user kxepal opened a pull request:

        https://github.com/apache/couchdb-couch/pull/29

        2534 db security respect authed users

        This does two things:

        • Fixes the way how user name is searched in list. lists:member/2 made in BIF, faster and doesn't causes redundant list copy;
        • Fixes readers vs members terminology in code;
        • Fixes COUCHDB-2534, throwing forbidden error if user is authenticated, but is not a database member.

        You can merge this pull request into a Git repository by running:

        $ git pull https://github.com/kxepal/couchdb-couch 2534-db-security-respect-authed-users

        Alternatively you can review and apply these changes as the patch at:

        https://github.com/apache/couchdb-couch/pull/29.patch

        To close this pull request, make a commit to your master/trunk branch
        with (at least) the following in the commit message:

        This closes #29


        commit d3c7d13346f3f5af679970bb80374d7c8f0a5b67
        Author: Alexander Shorin <kxepal@apache.org>
        Date: 2015-01-06T02:12:39Z

        Use lists:member/2 to check if user name is in list

        commit 3300fca3a35c0d0075a79af6a5662ff9537bc5e3
        Author: Alexander Shorin <kxepal@apache.org>
        Date: 2015-01-06T02:16:05Z

        Throw forbidden error if user is authenticated on db membership check

        COUCHDB-2534

        commit 7134d7ebd6d9d9c6586f37df9ef9aa2b6891b38a
        Author: Alexander Shorin <kxepal@apache.org>
        Date: 2015-01-06T02:19:32Z

        Normalize terminology readers vs members


        Show
        githubbot ASF GitHub Bot added a comment - GitHub user kxepal opened a pull request: https://github.com/apache/couchdb-couch/pull/29 2534 db security respect authed users This does two things: Fixes the way how user name is searched in list. lists:member/2 made in BIF, faster and doesn't causes redundant list copy; Fixes readers vs members terminology in code; Fixes COUCHDB-2534 , throwing forbidden error if user is authenticated, but is not a database member. You can merge this pull request into a Git repository by running: $ git pull https://github.com/kxepal/couchdb-couch 2534-db-security-respect-authed-users Alternatively you can review and apply these changes as the patch at: https://github.com/apache/couchdb-couch/pull/29.patch To close this pull request, make a commit to your master/trunk branch with (at least) the following in the commit message: This closes #29 commit d3c7d13346f3f5af679970bb80374d7c8f0a5b67 Author: Alexander Shorin <kxepal@apache.org> Date: 2015-01-06T02:12:39Z Use lists:member/2 to check if user name is in list commit 3300fca3a35c0d0075a79af6a5662ff9537bc5e3 Author: Alexander Shorin <kxepal@apache.org> Date: 2015-01-06T02:16:05Z Throw forbidden error if user is authenticated on db membership check COUCHDB-2534 commit 7134d7ebd6d9d9c6586f37df9ef9aa2b6891b38a Author: Alexander Shorin <kxepal@apache.org> Date: 2015-01-06T02:19:32Z Normalize terminology readers vs members
        Hide
        jira-bot ASF subversion and git services added a comment -

        Commit a5aa4e17c3593a484ee8665d8b4272be05bedfe9 in couchdb-couch's branch refs/heads/master from Alexander Shorin
        [ https://git-wip-us.apache.org/repos/asf?p=couchdb-couch.git;h=a5aa4e1 ]

        Improve checks for db admin/member

        • Use lists:member/2 to check if user name is in list
        • Throw forbidden error if user is authenticated on db membership check
        • Normalize terminology readers vs members
        • Make checks more Erlang-ish

        COUCHDB-2534

        Show
        jira-bot ASF subversion and git services added a comment - Commit a5aa4e17c3593a484ee8665d8b4272be05bedfe9 in couchdb-couch's branch refs/heads/master from Alexander Shorin [ https://git-wip-us.apache.org/repos/asf?p=couchdb-couch.git;h=a5aa4e1 ] Improve checks for db admin/member Use lists:member/2 to check if user name is in list Throw forbidden error if user is authenticated on db membership check Normalize terminology readers vs members Make checks more Erlang-ish COUCHDB-2534
        Hide
        githubbot ASF GitHub Bot added a comment -

        Github user asfgit closed the pull request at:

        https://github.com/apache/couchdb-couch/pull/29

        Show
        githubbot ASF GitHub Bot added a comment - Github user asfgit closed the pull request at: https://github.com/apache/couchdb-couch/pull/29
        Hide
        jira-bot ASF subversion and git services added a comment -

        Commit 350e4e60171bf1ccf90ebc5126304bc9870a1b03 in couchdb-cassim's branch refs/heads/master from Alexander Shorin
        [ https://git-wip-us.apache.org/repos/asf?p=couchdb-cassim.git;h=350e4e6 ]

        Reuse database security check routines from couch_db

        COUCHDB-2534

        Show
        jira-bot ASF subversion and git services added a comment - Commit 350e4e60171bf1ccf90ebc5126304bc9870a1b03 in couchdb-cassim's branch refs/heads/master from Alexander Shorin [ https://git-wip-us.apache.org/repos/asf?p=couchdb-cassim.git;h=350e4e6 ] Reuse database security check routines from couch_db COUCHDB-2534
        Hide
        jira-bot ASF subversion and git services added a comment -

        Commit 3f2cf84f9efe3114a7e82273be493ddf04e805f8 in couchdb's branch refs/heads/master from Alexander Shorin
        [ https://git-wip-us.apache.org/repos/asf?p=couchdb.git;h=3f2cf84 ]

        Return HTTP 403 for auth'ed users on request to private databases

        COUCHDB-2534

        Show
        jira-bot ASF subversion and git services added a comment - Commit 3f2cf84f9efe3114a7e82273be493ddf04e805f8 in couchdb's branch refs/heads/master from Alexander Shorin [ https://git-wip-us.apache.org/repos/asf?p=couchdb.git;h=3f2cf84 ] Return HTTP 403 for auth'ed users on request to private databases COUCHDB-2534
        Hide
        jira-bot ASF subversion and git services added a comment -

        Commit eeef2eec91bbcdea8bd86674604eddb1858cbde1 in couchdb's branch refs/heads/1.x.x from Alexander Shorin
        [ https://gitbox.apache.org/repos/asf?p=couchdb.git;h=eeef2ee ]

        Improve checks for db admin/member

        • Use lists:member/2 to check if user name is in list
        • Throw forbidden error if user is authenticated on db membership check
        • Normalize terminology readers vs members
        • Make checks more Erlang-ish

        COUCHDB-2534

        Show
        jira-bot ASF subversion and git services added a comment - Commit eeef2eec91bbcdea8bd86674604eddb1858cbde1 in couchdb's branch refs/heads/1.x.x from Alexander Shorin [ https://gitbox.apache.org/repos/asf?p=couchdb.git;h=eeef2ee ] Improve checks for db admin/member Use lists:member/2 to check if user name is in list Throw forbidden error if user is authenticated on db membership check Normalize terminology readers vs members Make checks more Erlang-ish COUCHDB-2534

          People

          • Assignee:
            kxepal Alexander Shorin
            Reporter:
            kxepal Alexander Shorin
          • Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development