Not allowing index names in request body for multi-get/search/bulk wh…

…en indices are already given in url closes #3636
elastic · Sep 5, 2013 · ccf098b · ccf098b
1 parent 3cb143f
commit ccf098b
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 2 deletions.
diff --git a/src/main/java/org/elasticsearch/action/bulk/BulkRequest.java b/src/main/java/org/elasticsearch/action/bulk/BulkRequest.java
@@ -155,6 +155,7 @@ BulkRequest internalAdd(UpdateRequest request, @Nullable Object payload) {
         }
         return this;
     }
+
     /**
      * Adds an {@link DeleteRequest} to the list of actions to execute.
      */

diff --git a/src/main/java/org/elasticsearch/action/get/MultiGetRequest.java b/src/main/java/org/elasticsearch/action/get/MultiGetRequest.java
@@ -236,6 +236,10 @@ public void add(@Nullable String defaultIndex, @Nullable String defaultType, @Nu
     }
 
     public void add(@Nullable String defaultIndex, @Nullable String defaultType, @Nullable String[] defaultFields, BytesReference data) throws Exception {
+        add(defaultIndex, defaultType, defaultFields, data, true);
+    }
+
+    public void add(@Nullable String defaultIndex, @Nullable String defaultType, @Nullable String[] defaultFields, BytesReference data, boolean allowExplicitIndex) throws Exception {
         XContentParser parser = XContentFactory.xContent(data).createParser(data);
         try {
             XContentParser.Token token;
@@ -260,6 +264,9 @@ public void add(@Nullable String defaultIndex, @Nullable String defaultType, @Nu
                                     currentFieldName = parser.currentName();
                                 } else if (token.isValue()) {
                                     if ("_index".equals(currentFieldName)) {
+                                        if (!allowExplicitIndex) {
+                                            throw new ElasticSearchIllegalArgumentException("explicit index in multi get is not allowed");
+                                        }
                                         index = parser.text();
                                     } else if ("_type".equals(currentFieldName)) {
                                         type = parser.text();

diff --git a/src/main/java/org/elasticsearch/rest/action/bulk/RestBulkAction.java b/src/main/java/org/elasticsearch/rest/action/bulk/RestBulkAction.java
@@ -24,8 +24,8 @@
 import org.elasticsearch.action.bulk.BulkItemResponse;
 import org.elasticsearch.action.bulk.BulkRequest;
 import org.elasticsearch.action.bulk.BulkResponse;
-import org.elasticsearch.action.index.IndexResponse;
 import org.elasticsearch.action.delete.DeleteResponse;
+import org.elasticsearch.action.index.IndexResponse;
 import org.elasticsearch.action.support.replication.ReplicationType;
 import org.elasticsearch.client.Client;
 import org.elasticsearch.client.Requests;

diff --git a/src/main/java/org/elasticsearch/rest/action/get/RestMultiGetAction.java b/src/main/java/org/elasticsearch/rest/action/get/RestMultiGetAction.java
@@ -39,6 +39,8 @@
 
 public class RestMultiGetAction extends BaseRestHandler {
 
+    private final boolean allowExplicitIndex;
+
     @Inject
     public RestMultiGetAction(Settings settings, Client client, RestController controller) {
         super(settings, client);
@@ -48,6 +50,8 @@ public RestMultiGetAction(Settings settings, Client client, RestController contr
         controller.registerHandler(POST, "/{index}/_mget", this);
         controller.registerHandler(GET, "/{index}/{type}/_mget", this);
         controller.registerHandler(POST, "/{index}/{type}/_mget", this);
+
+        this.allowExplicitIndex = settings.getAsBoolean("rest.action.multi.allow_explicit_index", true);
     }
 
     @Override
@@ -65,7 +69,7 @@ public void handleRequest(final RestRequest request, final RestChannel channel)
         }
 
         try {
-            multiGetRequest.add(request.param("index"), request.param("type"), sFields, request.content());
+            multiGetRequest.add(request.param("index"), request.param("type"), sFields, request.content(), allowExplicitIndex);
         } catch (Exception e) {
             try {
                 XContentBuilder builder = restContentBuilder(request);