Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-9609

Ensure users can only call getMore on cursors they created

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Closed
    • Major - P3
    • Resolution: Fixed
    • None
    • 3.5.5
    • Querying, Security
    • None
    • Minor Change
    • Query 2017-03-27

    Description

      A ClientCursor should be associated with the set of users that were authenticated when it was created. A getMore should only succeed if the intersection of currently authenticated users and the set of users associated with the ClientCursor is nonempty (or the set of users associated with the ClientCursor is empty).

      Attachments

        Issue Links

          is documented by

          Task - A task that needs to be done. DOCS-10023 Docs for SERVER-9609: Ensure users can only call getMore on cursors they created

          • Major - P3 - Major loss of function.
          • Closed
          related to

          Bug - A problem which impairs or prevents the functions of the product. SERVER-20364 Cursor is not closed when querying system.profile collection with clusterMonitor role

          • Major - P3 - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. SERVER-27899 Privilege problems with aggregation

          • Major - P3 - Major loss of function.
          • Closed

          New Feature - A new feature of the product, which has yet to be developed. SERVER-17856 users on mongods should always be able to run currentOp and killOp on their own operations

          • Major - P3 - Major loss of function.
          • Closed

          Task - A task that needs to be done. SERVER-28260 Create a killAnyCursor privilege

          • Major - P3 - Major loss of function.
          • Closed

          Improvement - An improvement or enhancement to an existing feature or task. SERVER-8369 kill cursor of an internal only ClientCursor used for yielding could cause memory corruption

          • Minor - P4 - Minor loss of function, or other problem where easy workaround is present.
          • Closed

          Activity

            People

              tess.avitabile@mongodb.com Tess Avitabile (Inactive)
              schwerin@mongodb.com Andy Schwerin
              Votes:
              1 Vote for this issue
              Watchers:
              14 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: