From d9feb32148d828871abded4703fe46a0522d9d85 Mon Sep 17 00:00:00 2001
From: Emily Stark <emily@meteor.com>
Date: Tue, 16 Dec 2014 13:16:34 -0800
Subject: [PATCH] Disallow EJSON custom types as replacement documents in
 updates

---
 packages/mongo/mongo_driver.js         | 10 +++++++++-
 packages/mongo/mongo_livedata_tests.js |  7 +++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/packages/mongo/mongo_driver.js b/packages/mongo/mongo_driver.js
index 822746e336..4cc97f310f 100644
--- a/packages/mongo/mongo_driver.js
+++ b/packages/mongo/mongo_driver.js
@@ -320,7 +320,7 @@ MongoConnection.prototype._insert = function (collection_name, document,
   if (!(LocalCollection._isPlainObject(document) &&
         !EJSON._isCustomType(document))) {
     sendError(new Error(
-      "Only documents (plain objects) may be inserted into MongoDB"));
+      "Only plain objects may be inserted into MongoDB"));
     return;
   }
 
@@ -432,6 +432,14 @@ MongoConnection.prototype._update = function (collection_name, selector, mod,
   if (!mod || typeof mod !== 'object')
     throw new Error("Invalid modifier. Modifier must be an object.");
 
+  if (!(LocalCollection._isPlainObject(mod) &&
+        !EJSON._isCustomType(mod))) {
+    throw new Error(
+      "Only plain objects may be used as replacement" +
+        " documents in MongoDB");
+    return;
+  }
+
   if (!options) options = {};
 
   var write = self._maybeBeginWrite();
diff --git a/packages/mongo/mongo_livedata_tests.js b/packages/mongo/mongo_livedata_tests.js
index 5fa38bb232..686992dfb0 100644
--- a/packages/mongo/mongo_livedata_tests.js
+++ b/packages/mongo/mongo_livedata_tests.js
@@ -1481,6 +1481,7 @@ testAsyncMulti('mongo-livedata - document with a custom type, ' + idGeneration,
       test.isFalse(err);
       test.isTrue(id);
       docId = id;
+      self.docId = docId;
       var cursor = self.coll.find();
       test.equal(cursor.count(), 1);
       var inColl = self.coll.findOne();
@@ -1493,6 +1494,12 @@ testAsyncMulti('mongo-livedata - document with a custom type, ' + idGeneration,
       test.isTrue(err);
       test.isFalse(id);
     }));
+  }, function (test, expect) {
+    var self = this;
+    self.coll.update(
+      self.docId, new Dog("rover", "orange"), expect(function (err) {
+        test.isTrue(err);
+      }));
   }
 ]);