Security issue in CouchDb - security

I see one strange thing happening to CouchDb. When I go Futon page I see that I need to login. Otherwise, I will get an error message Error: anathorized if I try to change some view function. And when I login, this error goes away. So, this seems ok.
What is not ok is that when I try to invoke some view with curl without providing user and password, I do not get any error message, but get some result. I do it like this:
curl -XGET 'http://127.0.0.1:5984/db/_design/query/_view/delete/?key="object_1_"'
This view ^^^ is supposed to return a long list of data. In fact, 26 rows. And this is what I see in Futon when I'm logged in. But here as a result of curl command I get:
{"total_rows":26,"offset":25,"rows":[{"id":"...","key":"object_1_","value":"..."}]}
So, as you can see I get one row of data. I have several questions. Why does CouchDb enable to query itself without providing user and password, when they are required? And why does it return so strange result - total_rows = 26, but in fact there is only one single row.
PS. Ubuntu 15.04, CouchDb 1.6.0
EDIT
If I provide user and password like this:
curl 'http://user:password#....similar'
then I still get this strange result with one row of data.

You did not restrict the database to any admins, admin_roles, users or user_roles - so ANYBODY has access to that database. This is DEFAULT and stated in the documentationen.
Why your view does return "strange results" does depend on your view and query.

Related

Github restapi: how to filter pulls requests by user?

I'm trying to use the github REST api to get pull requests by user. I've read the docs and looked for examples and can't find clear directions how to do this. The basic .../pulls url works just fine - I get back a big list of pull requests. But when I try to filter to a user the way the docs seem to say, I just back an empty array.
I have verified:
The user names I am trying are correct- I have copied them from the pulls.user.login field
The users I am trying have pulls that show up in the .../pulls output
Here is what I have tried:
These attempts always return an empty array:
[githost]/api/v3/repos/[owner]/[reponame]/pulls?head=user:myusername
[githost]/api/v3/repos/[owner]/[reponame]/pulls?head=user:myusername&state=all
[githost]/api/v3/repos/[owner]/[reponame]/pulls?head=user:myuserid
[githost]/api/v3/repos/[owner]/[reponame]/pulls?head=user:myusername#mydomain
These desperate attempts always return the same output as .../pulls with no parameters
[githost]/api/v3/repos/[owner]/[reponame]/pulls?head=myusername
[githost]/api/v3/repos/[owner]/[reponame]/pulls?user=myusername
So what is the correct way to do this?
According to the GitHub,
Every pull request is an issue, but not every issue is a pull request.
So try this to get the list of all PRs created by a specific user:
https://api.github.com/search/issues?q=author%3Agenialkartik+type%3Apr
Don't forget to replace my username 'genialkartik' with your username.
OK, I figured it out by using git's search api.
The query I used looks like this:
[githost]/api/v3/search/issues?per_page=50&q=type:pr+author:myusername
The results are little more terse than what .../pulls gives, but that's something I can work around.

UserEmailAddressException while login in Liferay

I'm trying to log-in in the login page of Liferay but It's showing UserEmailAddressException while calling authenticateByEmailAddress method in LoginUtil class of portal-Impl.jar.
I'm also getting the following warning.
No Group exists with the key {companyId=10113, classNameId=10039, classPK=10116} liferay
Here classPk is UserId but everytime it's taking the same value of classPk i.e 10116 instead It should take the logged in person's UserId from USER_ table.
I tried to find the implementation(code) of authenticateByEmailAddress method in portal-Impl.jar but couldn't find it. I failed to find how it's getting classPk=10116 that's where problem lies.
String authResult = UserLocalServiceUtil.authenticateByEmailAddress(company.getCompanyId(), login, password, headerMap, parameterMap);
When all the valid parameters are passed in authenticateByEmailAddress method. It should return 1. i.e successful authentication but UserEmailAddressException exception is being thrown.
"No Group exists with the key" error will occur when there is no corresponding entry in the group_ table .
in Latest versions of liferay, after successful login, an entry will created in the group_ table.
in this case, it may be corrupted/deleted. please check that way.
Thanks

When I go to admin/build/modules, anonymous users get access denied

I go to admin/build/modules, without changing anything, and click 'Save Configuration'
In the database table menu_router it remove the access_callback value for items that had a value of either 1 or 'user_access'.
As a result, on pages that anonymous users should be able to get to, they get a access denied message (You are not authorized to access this page).
I was able to set the values in the database manually, but this really isn't a long term solution every time I go to admin/build/modules.
Today is the first day this started happening. I did change some menu items because I wanted to update their function names. After updating it, I went to admin/build/modules, then devel/menu/reset, then admin/settings/performance and cleared cache. I'm not sure what exactly could have been done to cause this.
In the file includes/database.mysql.inc, in the function db_escape_string, I had some custom code.
function db_escape_string($text) {
global $active_db;
if (!is_string($text)){ return '';} //custom
return mysql_real_escape_string($text, $active_db);
}
I commented out my custom code and it works fine now.

How to do not reset search results in Yii zii.widgets.grid.cgridview

I have zii.widgets.grid.cgridview on admin page, and when I search some records and visit view one of them, and after return to admin page results is reseted. May I save them someway?
As a suggestion:
First disable Ajax update in your CGridView's view:
'ajaxUpdate' => false
Now, it sends data via GET request. If you save the current GET, it would be possible to use the result later. It is accessible with:
$_GET['YOUR_MODEL_NAME'];
If you want to use it in somewhere else, you can get values from GET and put it into a CDBCriteria.
Others might offer another way.

Couchdb: Browser Access to list records

I have just realised, all the curl commands being mentioned are able to be executed in the browser.
I can not seem to work out what is the correct command to get the output from a view.
My database is on iriscouch.
http://mysite.iriscouch.com/mydb/_design/myview
lists the view, but how do I run the view so that the records are displayed ?
Thanks - mcl
You need to insert _view into the url:
http://mysite.iriscouch.com/mydb/_design/mydesign/_view/myview

Resources