You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@couchdb.apache.org by "Klaus Trainer (JIRA)" <ji...@apache.org> on 2013/01/28 10:11:13 UTC
[jira] [Updated] (COUCHDB-1656) Anonymous Users and Non-Admins Can
Read the Security Object
[ https://issues.apache.org/jira/browse/COUCHDB-1656?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Klaus Trainer updated COUCHDB-1656:
-----------------------------------
Attachment: 0001-Don-t-give-non-admins-read-access-to-db-_security.patch
> Anonymous Users and Non-Admins Can Read the Security Object
> -----------------------------------------------------------
>
> Key: COUCHDB-1656
> URL: https://issues.apache.org/jira/browse/COUCHDB-1656
> Project: CouchDB
> Issue Type: Bug
> Components: Database Core
> Reporter: Klaus Trainer
> Attachments: 0001-Don-t-give-non-admins-read-access-to-db-_security.patch
>
>
> It is possible that anonymous users are able to read a DB's security object if the security object's `members` array is empty or missing. Also, it is generally possible for authenticated members (non-admin users) to read the security object.
> Only admin users should be allowed to read the security object.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira