Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-11866

Make renameCollectionSameDB only work if you have the same read permission on the source and dest collections

    XMLWordPrintableJSON

Details

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major - P3 Major - P3
    • 2.5.5
    • 2.5.4
    • Security
    • None
    • ALL

    Description

      Currently if you have renameCollectionSameDB on a database, you can rename any collection within that database. The problem is that you could potentially rename from a collection you don't have read access to to one that you do, which is potentially a security hole. We should only let renameCollectionSameDB work if you have read on source, or don't have read on dest.

      Attachments

        Activity

          People

            spencer@mongodb.com Spencer Brody (Inactive)
            spencer@mongodb.com Spencer Brody (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: