Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-33119

N1QL-FTS Integration: SEARCH_QUERY() user permissions problem

    XMLWordPrintable

Details

    Description

      I'm running query containing SEARCH_QUERY() function call using user with the following permissions:

      • Query CURL Access
      • Bucket level:
        • Query and Index Services - Query Select
        • Search Service - no permissions

      From my point of view, I should get empty results, since this user does not have a permission to use Search service, but I'm getting some results.

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          steve Steve Yen added a comment -

          Hi Abhinav – can you take a look at this one after you're all set with latest n1fty changes? – thx!

          steve Steve Yen added a comment - Hi Abhinav – can you take a look at this one after you're all set with latest n1fty changes? – thx!

          Hey Keshav Murthy, so i've verified what Evgeny Makarenko has reported here.

          This is more of a PM decision, and I'm ok with any approach we take here - when a user doesn't have search access but has query select access, should we allow the SEARCH(..) within a n1ql query to return results or not.

          p.s. Today the SEARCH(..) from within the n1ql query returns all results in the above situation.

          abhinav Abhinav Dangeti added a comment - Hey Keshav Murthy , so i've verified what Evgeny Makarenko has reported here. This is more of a PM decision, and I'm ok with any approach we take here - when a user doesn't have search access but has query select access, should we allow the SEARCH(..) within a n1ql query to return results or not. p.s. Today the SEARCH(..) from within the n1ql query returns all results in the above situation.

          Keshav Murthy says that this is OK.

          abhinav Abhinav Dangeti added a comment - Keshav Murthy says that this is OK.

          Worth documenting. Ping Amarantha Kulkarni

          abhinav Abhinav Dangeti added a comment - Worth documenting. Ping Amarantha Kulkarni

          Bulk closing Duplicat and Won't fix bugs

          arunkumar Arunkumar Senthilnathan (Inactive) added a comment - Bulk closing Duplicat and Won't fix bugs

          People

            abhinav Abhinav Dangeti
            evgeny.makarenko Evgeny Makarenko (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes

                PagerDuty