Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-38293

Make listDatabases understand collection privileges

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Major - P3
    • Resolution: Fixed
    • None
    • 4.0.6, 4.1.7
    • Security, Usability
    • Minor Change
    • ALL
    • v4.0
    • Security 2018-12-17

    Description

      listDatabases currently can produce a list of all databases the client is authorized for. It decides that a user is authorized if it possesses the find action on the database resource. However, a client may possess the find action (or any other action) on a collection resource inside of the database.

      listDatabases should return all databases for which the client possesses any action on the database or on any collection within the database.

      Attachments

        Issue Links

          Activity

            People

              isabella.siu@mongodb.com Isabella Siu (Inactive)
              spencer.jackson@mongodb.com Spencer Jackson
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: