void Command::execCommandClientBasic(Command * c ,
ClientBasic& client,
int queryOptions,
const char *ns,
BSONObj& cmdObj,
BSONObjBuilder& result,
bool fromRepl ) {
verify(c);
std::string dbname = nsToDatabase(ns);
// Access control checks
if (!noauth) {
std::vector<Privilege> privileges;
c->addRequiredPrivileges(dbname, cmdObj, &privileges);
AuthorizationManager* authManager = client.getAuthorizationManager();
if (!authManager->checkAuthForPrivileges(privileges).isOK()) {
result.append("note", str::stream() << "not authorized for command: " <<
c->name << " on database " << dbname);
appendCommandStatus(result, false, "unauthorized");
return;
}
}
if (c->adminOnly() && c->localHostOnlyIfNoAuth(cmdObj) && noauth &&
!client.getIsLocalHostConnection()) {
log() << "command denied: " << cmdObj.toString() << endl;
appendCommandStatus(result,
false,
"unauthorized: this command must run from localhost when running db "
"without auth");
return;
}
if (c->adminOnly() && !startsWith(ns, "admin.")) {
log() << "command denied: " << cmdObj.toString() << endl;
appendCommandStatus(result, false, "access denied - use admin db");
return;
}
// End of access control checks
if (cmdObj.getBoolField("help")) {
stringstream help;
help << "help for: " << c->name << " ";
c->help( help );
result.append( "help" , help.str() );
result.append( "lockType" , c->locktype() );
appendCommandStatus(result, true, "");
return;
}
std::string errmsg;
bool ok;
try {
ok = c->run( dbname , cmdObj, queryOptions, errmsg, result, false );
}
catch (DBException& e) {
ok = false;
int code = e.getCode();
if (code == RecvStaleConfigCode) { // code for StaleConfigException
throw;
}
stringstream ss;
ss << "exception: " << e.what();
errmsg = ss.str();
result.append( "code" , code );
}
appendCommandStatus(result, ok, errmsg);
}
bool AuthzSessionExternalStateServerCommon::shouldIgnoreAuthChecks() const {
ClientBasic* client = ClientBasic::getCurrent();
return !AuthorizationManager::isAuthEnabled() ||
(enableLocalhostAuthBypass &&client->getIsLocalHostConnection() && _allowLocalhost);
}
bool AuthExternalStateServerCommon::shouldIgnoreAuthChecks() const {
ClientBasic* client = ClientBasic::getCurrent();
return noauth ||
(enableLocalhostAuthBypass &&client->getIsLocalHostConnection() && _allowLocalhost);
}
bool AuthzSessionExternalStateServerCommon::shouldAllowLocalhost() const {
ClientBasic* client = ClientBasic::getCurrent();
return _allowLocalhost && client->getIsLocalHostConnection();
}
