From 5c0548eaf69cd7d9f09431bd5733990cb72eb2db Mon Sep 17 00:00:00 2001 From: Eric Avdey Date: Wed, 29 Aug 2018 14:54:53 -0300 Subject: [PATCH] Check if db exists in /db/_ensure_full_commit call We removed a security call in `do_db_req` to avoid a duplicate authorization check and as a result there are now no db validation in noop call `/db/_ensure_full_commit`. This makes it always return a success code, even for missing databases. This fix places the security check directly in _ensure_full_commit call and adds eunit tests for a good measure. --- src/chttpd/src/chttpd_db.erl | 7 ++++++- src/chttpd/test/chttpd_db_test.erl | 22 ++++++++++++++++++++++ 2 files changed, 28 insertions(+), 1 deletion(-) diff --git a/src/chttpd/src/chttpd_db.erl b/src/chttpd/src/chttpd_db.erl index d3655c35d12..49d7b58492b 100644 --- a/src/chttpd/src/chttpd_db.erl +++ b/src/chttpd/src/chttpd_db.erl @@ -375,8 +375,13 @@ db_req(#httpd{method='POST', path_parts=[DbName], user_ctx=Ctx}=Req, Db) -> db_req(#httpd{path_parts=[_DbName]}=Req, _Db) -> send_method_not_allowed(Req, "DELETE,GET,HEAD,POST"); -db_req(#httpd{method='POST',path_parts=[_,<<"_ensure_full_commit">>]}=Req, _Db) -> +db_req(#httpd{method='POST', path_parts=[DbName, <<"_ensure_full_commit">>], + user_ctx=Ctx}=Req, _Db) -> chttpd:validate_ctype(Req, "application/json"), + %% use fabric call to trigger a database_does_not_exist exception + %% for missing databases that'd return error 404 from chttpd + %% get_security used to prefer shards on the same node over other nodes + fabric:get_security(DbName, [{user_ctx, Ctx}]), send_json(Req, 201, {[ {ok, true}, {instance_start_time, <<"0">>} diff --git a/src/chttpd/test/chttpd_db_test.erl b/src/chttpd/test/chttpd_db_test.erl index 636603710c8..2708aa03390 100644 --- a/src/chttpd/test/chttpd_db_test.erl +++ b/src/chttpd/test/chttpd_db_test.erl @@ -61,6 +61,8 @@ all_test_() -> fun setup/0, fun teardown/1, [ fun should_return_ok_true_on_bulk_update/1, + fun should_return_ok_true_on_ensure_full_commit/1, + fun should_return_404_for_ensure_full_commit_on_no_db/1, fun should_accept_live_as_an_alias_for_continuous/1, fun should_return_404_for_delete_att_on_notadoc/1, fun should_return_409_for_del_att_without_rev/1, @@ -100,6 +102,26 @@ should_return_ok_true_on_bulk_update(Url) -> end). +should_return_ok_true_on_ensure_full_commit(Url0) -> + ?_test(begin + Url = Url0 ++ "/_ensure_full_commit", + {ok, RC, _, Body} = test_request:post(Url, [?CONTENT_JSON, ?AUTH], []), + {Json} = ?JSON_DECODE(Body), + ?assertEqual(201, RC), + ?assert(couch_util:get_value(<<"ok">>, Json)) + end). + + +should_return_404_for_ensure_full_commit_on_no_db(Url0) -> + ?_test(begin + Url = Url0 ++ "-missing-db" ++ "/_ensure_full_commit", + {ok, RC, _, Body} = test_request:post(Url, [?CONTENT_JSON, ?AUTH], []), + {Json} = ?JSON_DECODE(Body), + ?assertEqual(404, RC), + ?assertEqual(<<"not_found">>, couch_util:get_value(<<"error">>, Json)) + end). + + should_accept_live_as_an_alias_for_continuous(Url) -> GetLastSeq = fun(Bin) -> Parts = binary:split(Bin, <<"\n">>, [global]),