Hi-

I am able to update a collection created by a read write user using a read only user by invoking map reduce.

Following is the test scenario.

Wed Jun 29 00:36:08 [initandlisten] git version: a429cd4f535b2499cc4130b06ff7c26f41c00f04

===read write user created an out collection in m/r ===

MongoDB shell version: 1.8.1
connecting to: test
> use gp
switched to db gp
> db.auth("gp","gp");
1
> show collections
myColl
mytest
system.indexes
system.profile
system.users
> db.myColl.find();
{ "_id" : 1, "value" :

{ "count" : 2 }

}
> m
Wed Jun 29 02:14:43 ReferenceError: m is not defined (shell):1
> db.myColl.drop();
true
> m=function () {
... emit(this.x,

{count:1}

);
... }
function () {
emit(this.x,

{count:1}

);
}
> r=function (key, values) {
... var total = 0;
... for (var i = 0; i < values.length; i++)

{ ... total += values[i].count; ... }
... return {count:total};
... }
function (key, values) {
var total = 0;
for (var i = 0; i < values.length; i++) { total += values[i].count; }
return {count:total};
}
> res=db.mytest.mapReduce(m,r,{out:{reduce:"myColl"}});
{
"result" : "myColl",
"timeMillis" : 43,
"counts" : { "input" : 1, "emit" : 1, "output" : 1 },
"ok" : 1,
}

=======
Read only user able to update the collection using map reduce.
MongoDB shell version: 1.8.1
connecting to: test
> use gp
switched to db gp
> db.auth("gpr","gpr");
1
> m=function () {
... emit(this.x, {count:1});
... }
function () {
emit(this.x, {count:1});
}
> function (key, values) {
... var total = 0;
... for (var i = 0; i < values.length; i++) {... total += values[i].count;... }

... return

{count:total}

;
... }
function (key, values) {
var total = 0;
for (var i = 0; i < values.length; i++)

{ total += values[i].count; }
return {count:total};
}
> res=db.mytest.mapReduce(m,r,{out:{reduce:"myColl"}});
Wed Jun 29 02:18:21 ReferenceError: r is not defined (shell):1
> r=function (key, values) {
... var total = 0;
... for (var i = 0; i < values.length; i++) { ... total += values[i].count; ... }
... return {count:total};
... }
function (key, values) {
var total = 0;
for (var i = 0; i < values.length; i++) { total += values[i].count; }

return

{count:total}

;
}
> res=db.mytest.mapReduce(m,r,{out:{reduce:"myColl"}});
{
"result" : "myColl",
"timeMillis" : 42,
"counts" :

{ "input" : 1, "emit" : 1, "output" : 1 }

,
"ok" : 1,
}
> db.myColl.find();
{ "_id" : 1, "value" :

{ "count" : 2 }

}
>
> res=db.mytest.mapReduce(m,r,{out:{reduce:"myColl"}});
{
"result" : "myColl",
"timeMillis" : 15,
"counts" :

{ "input" : 1, "emit" : 1, "output" : 1 }

,
"ok" : 1,
}
> db.myColl.find();
{ "_id" : 1, "value" :

{ "count" : 3 }

}
>
=====

> db.system.users.find();

{ "_id" : ObjectId("4e0a2530e1c6ac893f943018"), "user" : "gpr", "readOnly" : true, "pwd" : "6653a4201479409166809ecdd8abaadf" } { "_id" : ObjectId("4e0a2560e1c6ac893f943019"), "user" : "gp", "readOnly" : false, "pwd" : "2e42611f30c3155c7f8de180b0e855ee" }

>