SERVER-50116 Forbid oplog writes when replication is enabled

(cherry picked from commit 7b2913a64bc8812a9ab71ce27fe14bb2f517376f)
(cherry picked from commit 73dd69d37bc64c58a800c8d1225e35d3ca6241cb)

1 files changed, 4 insertions, 0 deletions

diff --git a/src/mongo/db/ops/insert.cpp b/src/mongo/db/ops/insert.cpp
index ebb5e702ae5..35378d58555 100644
--- a/src/mongo/db/ops/insert.cpp
+++ b/src/mongo/db/ops/insert.cpp
@@ -38,6 +38,7 @@
 #include "mongo/bson/bson_depth.h"
 #include "mongo/db/logical_clock.h"
 #include "mongo/db/logical_time.h"
+#include "mongo/db/repl/replication_coordinator.h"
 #include "mongo/db/views/durable_view_catalog.h"
 #include "mongo/util/mongoutils/str.h"
 
@@ -190,6 +191,9 @@ Status userAllowedWriteNS(StringData db, StringData coll) {
     if (coll == "system.profile") {
         return Status(ErrorCodes::InvalidNamespace,
                       str::stream() << "cannot write to '" << db << ".system.profile'");
+    } else if (db == "local" && coll == "oplog.rs" &&
+               repl::ReplicationCoordinator::get(getGlobalServiceContext())->isReplEnabled()) {
+        return Status(ErrorCodes::InvalidNamespace, "cannot write to 'local.oplog.rs'");
     }
     if (coll == "system.indexes") {
         return Status::OK();