[GitHub] tmende opened a new issue #974: Access to db/_all_docs results in 500 in 1.7.0 if user is only a DB member

[GitBox <gi...@apache.org>]

tmende opened a new issue #974: Access to db/_all_docs results in 500 in 1.7.0 if user is only a DB member
URL: https://github.com/apache/couchdb/issues/974
 
 
   ## Expected Behavior
   
   When accessing the endpoint db/_all_docs with a user that is defined as a member in the security object, I expect to get access to all documents, which is the case for CouchDB 1.6.1 (tested with the docker image couchdb:1.6.1).
   
   ## Current Behavior
   
   CouchDB 1.7.0 (tested with a docker image  couchdb:1.7.0) will return HTTP 500 "forbidden,<<\"You are not a db or server admin.\">>" for the same request.
   
   ## Steps to Reproduce (for bugs)
   
   **CouchDB 1.6.1 (access to _all_docs is possible):**
   
   `$ docker run -e COUCHDB_USER=admin -e COUCHDB_PASSWORD=password -p 5984:5984 --name couchdb161 -d couchdb:1.6.1
   $ COUCH161=http://127.0.0.1:5984
   $ curl -u admin:password -X PUT $COUCH161/my_db
   $ curl -u admin:password -HContent-Type:application/json -XPUT $COUCH161/_users/org.couchdb.user:foo --data-binary '{"_id": "org.couchdb.user:foo","name": "foo","roles": [],"type": "user","password": "secret"}'
   $ curl -u admin:password -X PUT $COUCH161/my_db/_security -d '{"members":{"names":["foo"], "roles":[]}}'
   
   $ curl -i -u foo:secret $COUCH161/my_db/_all_docs
   HTTP/1.1 200 OK
   Transfer-Encoding: chunked
   Server: CouchDB/1.6.1 (Erlang OTP/17)
   ETag: "DQ33O408457E9YLAX8TIS1VT1"
   Date: Wed, 08 Nov 2017 10:39:01 GMT
   Content-Type: text/plain; charset=utf-8
   Cache-Control: must-revalidate
   
   {"total_rows":0,"offset":0,"rows":[
   
   ]}`
   
   **CouchDB 1.7.0 (access to _all_docs results in 500 error):**
   
   $ docker run -e COUCHDB_USER=admin -e COUCHDB_PASSWORD=password -p 5985:5984 --name couchdb170 -d couchdb:1.7.0
   $ COUCH170=http://127.0.0.1:5985
   $ curl -u admin:password -X PUT $COUCH170/my_db
   $ curl -u admin:password -HContent-Type:application/json -XPUT $COUCH170/_users/org.couchdb.user:foo --data-binary '{"_id": "org.couchdb.user:foo","name": "foo","roles": [],"type": "user","password": "secret"}'
   $ curl -u admin:password -X PUT $COUCH170/my_db/_security -d '{"members":{"names":["foo"], "roles":[]}}'
   
   $ curl -i -u foo:secret $COUCH170/my_db/_all_docs
   HTTP/1.1 500 Internal Server Error
   Server: CouchDB/1.7.0 (Erlang OTP/17)
   Date: Wed, 08 Nov 2017 10:39:13 GMT
   Content-Type: text/plain; charset=utf-8
   Content-Length: 89
   Cache-Control: must-revalidate
   
   {"error":"case_clause","reason":"{forbidden,<<\"You are not a db or server admin.\">>}"}
   `
   
   ## Context
   I discovered it due to replication errors using PouchDB (6.3.4). The same app works fine with 1.6.1. When making the user foo a DB-admin, access in 1.7 works also correctly.
   
   ## Your Environment
   * Docker images 1.6.1 & 1.7.0 from https://hub.docker.com/_/couchdb/
   * Docker 17.11.0-ce-rc2-mac37 running in OS X 10.13.1
   

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services