SERVER-35804 Disallow dropping config and admin from mongos

2 files changed, 12 insertions, 0 deletions

diff --git a/src/mongo/s/commands/cluster_drop_cmd.cpp b/src/mongo/s/commands/cluster_drop_cmd.cpp
index c8ddc7a5dd2..d86a94c9816 100644
--- a/src/mongo/s/commands/cluster_drop_cmd.cpp
+++ b/src/mongo/s/commands/cluster_drop_cmd.cpp
@@ -73,6 +73,14 @@ public:
 
         const NamespaceString nss(CommandHelpers::parseNsCollectionRequired(dbname, cmdObj));
 
+        uassert(ErrorCodes::IllegalOperation,
+                "Cannot drop collection in config database",
+                nss.db() != NamespaceString::kConfigDb);
+
+        uassert(ErrorCodes::IllegalOperation,
+                "Cannot drop collection in admin database",
+                nss.db() != NamespaceString::kAdminDb);
+
         // Invalidate the routing table cache entry for this collection so that we reload it the
         // next time it is accessed, even if sending the command to the config server fails due
         // to e.g. a NetworkError.
diff --git a/src/mongo/s/commands/cluster_drop_database_cmd.cpp b/src/mongo/s/commands/cluster_drop_database_cmd.cpp
index 97e29270615..497b167b844 100644
--- a/src/mongo/s/commands/cluster_drop_database_cmd.cpp
+++ b/src/mongo/s/commands/cluster_drop_database_cmd.cpp
@@ -74,6 +74,10 @@ public:
                 "Cannot drop the config database",
                 dbname != NamespaceString::kConfigDb);
 
+        uassert(ErrorCodes::IllegalOperation,
+                "Cannot drop the admin database",
+                dbname != NamespaceString::kAdminDb);
+
         uassert(ErrorCodes::BadValue,
                 "have to pass 1 as db parameter",
                 cmdObj.firstElement().isNumber() && cmdObj.firstElement().number() == 1);