New upstream version 3.4.18upstream/3.4.18

1 files changed, 6 insertions, 1 deletions

diff --git a/src/mongo/db/auth/authorization_session.cpp b/src/mongo/db/auth/authorization_session.cpp
index a91f350e24d..c4f219c15de 100644
--- a/src/mongo/db/auth/authorization_session.cpp
+++ b/src/mongo/db/auth/authorization_session.cpp
@@ -679,7 +679,12 @@ static int buildResourceSearchList(const ResourcePattern& target,
             // Some databases should not be matchable with ResourcePattern::forAnyNormalResource.
             // 'local' and 'config' are used to store special system collections, which user level
             // administrators should not be able to manipulate.
-            if (target.ns().db() != "local" && target.ns().db() != "config") {
+            // '$setFeatureCompatibilityVersion' is a virtual database that
+            // setFeatureCompatibilityVersion performs auth checks against. When this command was
+            // first written, there was a moratorium on creating new ActionTypes. SERVER-31983
+            // introduced the ActionType after the moratorium expired.
+            if (target.ns().db() != "local" && target.ns().db() != "config" &&
+                target.ns().db() != "$setFeatureCompatibilityVersion") {
                 resourceSearchList[size++] = ResourcePattern::forAnyNormalResource();
             }
             resourceSearchList[size++] = ResourcePattern::forDatabaseName(target.ns().db());