SERVER-37836 re-evaluate authorization for originating command in getMore

1 files changed, 8 insertions, 2 deletions

diff --git a/src/mongo/db/commands/distinct.cpp b/src/mongo/db/commands/distinct.cpp
index 4d0f1dd70ea..f26feb2cf80 100644
--- a/src/mongo/db/commands/distinct.cpp
+++ b/src/mongo/db/commands/distinct.cpp
@@ -144,8 +144,14 @@ public:
                 return viewAggRequest.getStatus();
             }
 
-            return runAggregate(
-                opCtx, nss, viewAggRequest.getValue(), viewAggregation.getValue(), result);
+            // An empty PrivilegeVector is acceptable because these privileges are only checked on
+            // getMore and explain will not open a cursor.
+            return runAggregate(opCtx,
+                                nss,
+                                viewAggRequest.getValue(),
+                                viewAggregation.getValue(),
+                                PrivilegeVector(),
+                                result);
         }
 
         Collection* const collection = ctx->getCollection();