tree f6123331738f9677257b55b7604046b0bb58a8ff
parent 6acdb2203e5b97030014d18ab1fa83d1e3828038
author Robert Newson <rnewson@apache.org> 1408635299 +0100
committer Robert Newson <rnewson@apache.org> 1408635299 +0100

Don't upgrade admin hashes into the _users database

Admin users are stored in .ini files and are not full-fledged user
documents. Internally, a fake document is made to allow insertion into
the auth cache. CouchDB 1.6 introduced a feature to upgrade password
hashes from the legacy simple hash scheme to the stronger PBKDF2
scheme. It inappropriately attempted to do this to the fake admin
docs, which do not pass the _design/_auth validation checks. This is
fortunate, however, as CouchDB would then have written the admin users
into the users database causing widespread confusion and fear.