Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-5120

readonly user can save data through mapreduce function with a out-collectionName

    XMLWordPrintableJSON

Details

    • Icon: Bug Bug
    • Resolution: Duplicate
    • Icon: Critical - P2 Critical - P2
    • None
    • 1.8.0
    • Security
    • None
    • windows-release version
    • ALL

    Description

      readonly user can save data through mapreduce function with a out-collectionName
      1、create a readonly user on a db
      2、use this user to connect and auth on command line
      3、test "readOnly" works well by db.coll.save,then it fail and print "unauthorized"
      // but ...
      4、create a simple map-reduce function test, such http://api.mongodb.org/wiki/current/MapReduce.html, Examples => Shell Example 1, and specify out-param with a name "coll".
      5、after map-reduce finish, we will see the result in the "coll".

      in another words, with a magic map/reduce function, a readOnly user can save anything...
      it's terrible.

      Attachments

        Activity

          People

            Unassigned Unassigned
            kimmking kimmking
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: