5 ms·
Also worth noting: By default, CouchDB is setup so that the entire instance gives every HTTP user global administration rights.
by grannyg00se 15y ago
Also worth noting: By default, CouchDB is setup so that the entire instance gives every HTTP user global administration rights.
- LeafStorm 15y agoThat's so you can get started developing quickly. You're supposed to configure your users and permissions before you release to the public, and CouchDB helpfully displays a message in Futon saying, "You're in Admin Party mode!" to remind you of this.
- grannyg00se 15y agoExactly. Which makes it all the more surprising that this could have happened. As soon as you realize your entire instance is left open by default, it should immediately cause you to check the default security settings on the system databases to see if there is a "party" going on there as well.