SERVER-10231 disallow creation of indexes on system.indexes

Conflicts:
	src/mongo/db/index.cpp
	src/mongo/db/namespacestring.h

3 files changed, 24 insertions, 2 deletions

diff --git a/jstests/indexes_on_indexes.js b/jstests/indexes_on_indexes.js
new file mode 100644
index 00000000000..807c1e25bfd
--- /dev/null
+++ b/jstests/indexes_on_indexes.js
@@ -0,0 +1,19 @@
+// ensure an index cannot be created on system.indexes
+t = db.getSiblingDB("indexes_on_indexes");
+printjson(t.system.indexes.getIndexes());
+assert.eq(t.system.indexes.getIndexes().length, 0);
+print("trying via ensureIndex");
+assert.throws(t.system.indexes.ensureIndex({_id:1}));
+printjson(t.system.indexes.getIndexes());
+assert.eq(t.system.indexes.getIndexes().length, 0);
+print("trying via createIndex");
+assert.throws(t.system.indexes.createIndex({_id:1}));
+printjson(t.system.indexes.getIndexes());
+assert.eq(t.system.indexes.getIndexes().length, 0);
+print("trying via direct insertion");
+assert.throws(t.system.indexes.insert({ v:1,
+                                        key:{_id:1},
+                                        ns: "indexes_on_indexes.system.indexes",
+                                        name:"wontwork"}));
+printjson(t.system.indexes.getIndexes());
+assert.eq(t.system.indexes.getIndexes().length, 0);
diff --git a/src/mongo/db/index.cpp b/src/mongo/db/index.cpp
index f7346978313..c2e536739a1 100644
--- a/src/mongo/db/index.cpp
+++ b/src/mongo/db/index.cpp
@@ -334,9 +334,11 @@ namespace mongo {
 
         // the collection for which we are building an index
         sourceNS = io.getStringField("ns");
+        NamespaceString nss(sourceNS);
         uassert(10096, "invalid ns to index", sourceNS.find( '.' ) != string::npos);
-        massert(10097, str::stream() << "bad table to index name on add index attempt current db: " << cc().database()->name << "  source: " << sourceNS ,
-                cc().database()->name == nsToDatabase(sourceNS));
+        uassert(17072, "cannot create indexes on the system.indexes collection",
+                !nss.isSystemDotIndexes());
+        massert(10097, str::stream() << "bad table to index name on add index attempt current db: " << cc().database()->name << "  source: " << sourceNS , cc().database()->name == nsToDatabase(sourceNS));
 
         // logical name of the index.  todo: get rid of the name, we don't need it!
         const char *name = io.getStringField("name");
diff --git a/src/mongo/db/namespacestring.h b/src/mongo/db/namespacestring.h
index d108bbaac72..96d78230b39 100644
--- a/src/mongo/db/namespacestring.h
+++ b/src/mongo/db/namespacestring.h
@@ -46,6 +46,7 @@ namespace mongo {
 
         bool isSystem() const { return strncmp(coll.c_str(), "system.", 7) == 0; }
         bool isCommand() const { return coll == "$cmd"; }
+        bool isSystemDotIndexes() const { return strncmp(coll.c_str(), "system.indexes", 14) == 0; }
 
         /**
          * @return true if the namespace is valid. Special namespaces for internal use are considered as valid.