SERVER-29371 DocumentSource classes should provide auth requirements

1 files changed, 32 insertions, 1 deletions

diff --git a/src/mongo/db/pipeline/document_source_current_op.cpp b/src/mongo/db/pipeline/document_source_current_op.cpp
index 6a37192f8ad..b49d7de702c 100644
--- a/src/mongo/db/pipeline/document_source_current_op.cpp
+++ b/src/mongo/db/pipeline/document_source_current_op.cpp
@@ -48,9 +48,40 @@ const StringData kShardFieldName = "shard"_sd;
 using boost::intrusive_ptr;
 
 REGISTER_DOCUMENT_SOURCE(currentOp,
-                         LiteParsedDocumentSourceDefault::parse,
+                         DocumentSourceCurrentOp::LiteParsed::parse,
                          DocumentSourceCurrentOp::createFromBson);
 
+std::unique_ptr<DocumentSourceCurrentOp::LiteParsed> DocumentSourceCurrentOp::LiteParsed::parse(
+    const AggregationRequest& request, const BSONElement& spec) {
+    // Need to check the value of allUsers; if true then inprog privilege is required.
+    if (spec.type() != BSONType::Object) {
+        uasserted(ErrorCodes::TypeMismatch,
+                  str::stream() << "$currentOp options must be specified in an object, but found: "
+                                << typeName(spec.type()));
+    }
+
+    bool allUsers = false;
+
+    // Check the spec for all fields named 'allUsers'. If any of them are 'true', we require
+    // the 'inprog' privilege. This avoids the possibility that a spec with multiple
+    // allUsers fields might allow an unauthorized user to view all operations.
+    for (auto&& elem : spec.embeddedObject()) {
+        if (elem.fieldNameStringData() == "allUsers"_sd) {
+            if (elem.type() != BSONType::Bool) {
+                uasserted(ErrorCodes::TypeMismatch,
+                          str::stream() << "The 'allUsers' parameter of the $currentOp stage "
+                                           "must be a boolean value, but found: "
+                                        << typeName(elem.type()));
+            }
+
+            allUsers = allUsers || elem.boolean();
+        }
+    }
+
+    return stdx::make_unique<DocumentSourceCurrentOp::LiteParsed>(allUsers);
+}
+
+
 const char* DocumentSourceCurrentOp::getSourceName() const {
     return "$currentOp";
 }