Couchdb: Access to db/_all_docs results in 500 in 1.7.0 if user is only a DB member

Created on 8 Nov 2017 · 12Comments · Source: apache/couchdb

Expected Behavior

When accessing the endpoint db/_all_docs with a user that is defined as a member in the security object, I expect to get access to all documents, which is the case for CouchDB 1.6.1 (tested with the docker image couchdb:1.6.1).

Current Behavior

CouchDB 1.7.0 (tested with a docker image couchdb:1.7.0) will return HTTP 500 "forbidden,<<\"You are not a db or server admin.\">>" for the same request.

Steps to Reproduce (for bugs)

CouchDB 1.6.1 (access to _all_docs is possible):

`$ docker run -e COUCHDB_USER=admin -e COUCHDB_PASSWORD=password -p 5984:5984 --name couchdb161 -d couchdb:1.6.1
$ COUCH161=http://127.0.0.1:5984
$ curl -u admin:password -X PUT $COUCH161/my_db
$ curl -u admin:password -HContent-Type:application/json -XPUT $COUCH161/_users/org.couchdb.user:foo --data-binary '{"_id": "org.couchdb.user:foo","name": "foo","roles": [],"type": "user","password": "secret"}'
$ curl -u admin:password -X PUT $COUCH161/my_db/_security -d '{"members":{"names":["foo"], "roles":[]}}'

$ curl -i -u foo:secret $COUCH161/my_db/_all_docs
HTTP/1.1 200 OK
Transfer-Encoding: chunked
Server: CouchDB/1.6.1 (Erlang OTP/17)
ETag: "DQ33O408457E9YLAX8TIS1VT1"
Date: Wed, 08 Nov 2017 10:39:01 GMT
Content-Type: text/plain; charset=utf-8
Cache-Control: must-revalidate

{"total_rows":0,"offset":0,"rows":[

]}`

CouchDB 1.7.0 (access to _all_docs results in 500 error):

$ docker run -e COUCHDB_USER=admin -e COUCHDB_PASSWORD=password -p 5985:5984 --name couchdb170 -d couchdb:1.7.0
$ COUCH170=http://127.0.0.1:5985
$ curl -u admin:password -X PUT $COUCH170/my_db
$ curl -u admin:password -HContent-Type:application/json -XPUT $COUCH170/_users/org.couchdb.user:foo --data-binary '{"_id": "org.couchdb.user:foo","name": "foo","roles": [],"type": "user","password": "secret"}'
$ curl -u admin:password -X PUT $COUCH170/my_db/_security -d '{"members":{"names":["foo"], "roles":[]}}'

$ curl -i -u foo:secret $COUCH170/my_db/_all_docs
HTTP/1.1 500 Internal Server Error
Server: CouchDB/1.7.0 (Erlang OTP/17)
Date: Wed, 08 Nov 2017 10:39:13 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 89
Cache-Control: must-revalidate

{"error":"case_clause","reason":"{forbidden,<<\"You are not a db or server admin.\">>}"}
`

Context

I discovered it due to replication errors using PouchDB (6.3.4). The same app works fine with 1.6.1. When making the user foo a DB-admin, access in 1.7 works also correctly.

Your Environment

Docker images 1.6.1 & 1.7.0 from https://hub.docker.com/_/couchdb/
Docker 17.11.0-ce-rc2-mac37 running in OS X 10.13.1

api bug

Source

tmende

👍7

All 12 comments

Some significant changes to this part of the codebase landed in https://github.com/apache/couchdb-couch/pull/29. I think that's the place to look.

kocolosk on 8 Nov 2017

@tmende thank you for the detailed bug report! It really does simplify things when we have detailed reproducer steps, so the extra effort is greatly appreciated!

Good call @kocolosk, the underlying issue from that PR is the introduction of second auth failure type forbidden, in addition to just unauthorized [1], without the corresponding case clause to handle it [2]. There's a simple fix in #975.

[1] https://github.com/apache/couchdb/blob/5f88da2a5ee8ba78917fafd572c7b9fa37e76460/src/couchdb/couch_db.erl#L388-L391
[2] https://github.com/apache/couchdb/blob/5f88da2a5ee8ba78917fafd572c7b9fa37e76460/src/couch_mrview/src/couch_mrview_http.erl#L158-L163

chewbranca on 9 Nov 2017

This bug prevents us from migrating to 1.7.0 or doing any testing, because it breaks our application completely. Are there any chances of postponing publication of the description of the security problems that triggered the 1.7.0 release in the first place? I'm afraid that we won't be able to do extensive tests before November 14th.