f23002e965
The shell should attach the logical session used to initiate cursors (via find or aggregate) and use it for successive getMores.
37 lines
1.4 KiB
JavaScript
37 lines
1.4 KiB
JavaScript
// SERVER-8802: Test that you can't build indexes on system.users and use that to drop users with
|
|
// dropDups.
|
|
var conn = MongoRunner.runMongod({auth: ""});
|
|
|
|
var adminDB = conn.getDB("admin");
|
|
var testDB = conn.getDB("test");
|
|
adminDB.createUser({user: 'admin', pwd: 'x', roles: ['userAdminAnyDatabase']});
|
|
adminDB.auth('admin', 'x');
|
|
adminDB.createUser({user: 'mallory', pwd: 'x', roles: ['readWriteAnyDatabase']});
|
|
testDB.createUser({user: 'user', pwd: 'x', roles: ['read']});
|
|
assert.eq(3, adminDB.system.users.count());
|
|
adminDB.logout();
|
|
|
|
adminDB.auth('mallory', 'x');
|
|
var res = adminDB.system.users.createIndex({haxx: 1}, {unique: true, dropDups: true});
|
|
assert(!res.ok);
|
|
assert.eq(13, res.code); // unauthorized
|
|
assert.writeError(adminDB.exploit.system.indexes.insert(
|
|
{ns: "admin.system.users", key: {haxx: 1.0}, name: "haxx_1", unique: true, dropDups: true}));
|
|
// Make sure that no indexes were built.
|
|
var collectionInfosCursor = adminDB.runCommand("listCollections", {
|
|
filter: {
|
|
$and: [
|
|
{name: /^admin\.system\.users\.\$/},
|
|
{name: {$ne: "admin.system.users.$_id_"}},
|
|
{name: {$ne: "admin.system.users.$user_1_db_1"}}
|
|
]
|
|
}
|
|
});
|
|
|
|
assert.eq([], new DBCommandCursor(adminDB, collectionInfosCursor).toArray());
|
|
adminDB.logout();
|
|
|
|
adminDB.auth('admin', 'x');
|
|
// Make sure that no users were actually dropped
|
|
assert.eq(3, adminDB.system.users.count());
|