Hawkin
/
arangodb
mirror of https://gitee.com/bigwinds/arangodb
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix deleting rocksdb views and dump_authentication (#5779) 

* fix deleting rocksdb views and dump_authentication

* fix changelog, fix test
This commit is contained in:
Simon 2018-07-05 09:40:43 +02:00 committed by Jan
parent 222f77249f
commit f699d32664
4 changed files with 26 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG
View File

@ -1,6 +1,9 @@
devel
-----
* if authentication is turned on requests to databases by users with insufficient rights
will be answered with the HTTP forbidden (401) response.
* upgraded bundled RocksDB library version to 5.14
* added key generators `uuid` and `padded`

21
arangod/GeneralServer/GeneralCommTask.cpp
View File

@ -136,16 +136,21 @@ bool resolveRequestContext(GeneralRequest& req) {
/// response if execution is supposed to be aborted
GeneralCommTask::RequestFlow GeneralCommTask::prepareExecution(
GeneralRequest& req) {
if (!::resolveRequestContext(req)) {
if (!::resolveRequestContext(req)) { // false if db not found
if (_auth->isActive()) {
// prevent guessing of database names (issue #5030)
addErrorResponse(rest::ResponseCode::UNAUTHORIZED,
req.contentTypeResponse(), req.messageId(),
TRI_ERROR_FORBIDDEN);
} else {
addErrorResponse(rest::ResponseCode::NOT_FOUND, req.contentTypeResponse(),
req.messageId(), TRI_ERROR_ARANGO_DATABASE_NOT_FOUND);
// prevent guessing database names (issue #5030)
auth::Level lvl = auth::Level::NONE;
if (req.authenticated()) {
lvl = _auth->userManager()->databaseAuthLevel(req.user(), req.databaseName());
}
if (lvl == auth::Level::NONE) {
addErrorResponse(rest::ResponseCode::UNAUTHORIZED, req.contentTypeResponse(),
req.messageId(), TRI_ERROR_FORBIDDEN);
return RequestFlow::Abort;
}
}
addErrorResponse(rest::ResponseCode::NOT_FOUND, req.contentTypeResponse(),
req.messageId(), TRI_ERROR_ARANGO_DATABASE_NOT_FOUND);
return RequestFlow::Abort;
}
TRI_ASSERT(req.requestContext() != nullptr);

2
arangod/RocksDBEngine/RocksDBIndex.cpp
View File

@ -332,7 +332,7 @@ RocksDBKeyBounds RocksDBIndex::getBounds(Index::IndexType type,
return RocksDBKeyBounds::GeoIndex(objectId);
#ifdef USE_IRESEARCH
case RocksDBIndex::TRI_IDX_TYPE_IRESEARCH_LINK:
return RocksDBKeyBounds::Empty();
return RocksDBKeyBounds::DatabaseViews(objectId);
#endif
case RocksDBIndex::TRI_IDX_TYPE_UNKNOWN:
default:

11
js/client/tests/authentication/auth.js
View File

@ -495,7 +495,7 @@ function AuthSuite() {
"preferred_username": "root",
"iss": "arangodb", "exp": Math.floor(Date.now() / 1000) + 3600
}, 'HS256');
// should respond with unauthorized name guessing
// should respond with not-found because we are root
var res = request.get({
url: baseUrl() + "/_db/nonexisting/_api/version",
auth: {
@ -503,7 +503,14 @@ function AuthSuite() {
}
});
expect(res).to.be.an.instanceof(request.Response);
expect(res).to.have.property('statusCode', 401);
expect(res).to.have.property('statusCode', 404);
// should prevent name guessing by unauthorized users
var res = request.get({
url: baseUrl() + "/_db/nonexisting/_api/version"
});
expect(res).to.be.an.instanceof(request.Response);
expect(res).to.have.property('statusCode', 404);
},
testDatabaseListNonSystem: function() {