Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-73177

Make API compatibility check ignore access checks introduced by new aggregation stages

    XMLWordPrintableJSON

Details

    • Icon: Task Task
    • Resolution: Fixed
    • Icon: Major - P3 Major - P3
    • 6.3.0-rc0
    • None
    • None
    • None
    • Fully Compatible
    • Sharding NYC 2023-02-06

    Description

      For the permission compatibility check, it is safe to skip the permissions required only by new aggregation stages that are not present in the previous release. SERVER-63748 has made the compatibility check ignore privileges introduced by new aggregation stages. Specifically, it made the script ignore every "privilege" that is associated with an agg_stage not present in the old IDL (e.g. here). However, beside privileges, there are also access checks (defined here). Likewise, access checks that are introduced by new aggregate stages should also be ignored in the compatibility check. This is required by SERVER-68757 which will add a new aggregation stage that internally runs a find command which sometimes requires getMore commands, and therefore requires the check_cursor_session_privilege access check. 

      Attachments

        Activity

          People

            cheahuychou.mao@mongodb.com Cheahuychou Mao
            cheahuychou.mao@mongodb.com Cheahuychou Mao
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: