Merge branch 'w/8.7/bugfix/CLDSRV-555-deleteObjects-policy-eval-fix' …

…into tmp/octopus/w/8.8/bugfix/CLDSRV-555-deleteObjects-policy-eval-fix
scality · Jul 15, 2024 · 57d46a7 · 57d46a7
2 parents 9b34fc6 + 31892ee
commit 57d46a7
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/lib/api/multiObjectDelete.js b/lib/api/multiObjectDelete.js
@@ -508,8 +508,9 @@ function multiObjectDelete(authInfo, request, log, callback) {
                 if (bucketShield(bucketMD, 'objectDelete')) {
                     return next(errors.NoSuchBucket);
                 }
-                if (!isBucketAuthorized(bucketMD, 'objectDelete', canonicalID, authInfo, log, request,
-                    false)) {
+                // The implicit deny flag is ignored in the DeleteObjects API, as authorization only
+                // affects the objects.
+                if (!isBucketAuthorized(bucketMD, 'objectDelete', canonicalID, authInfo, log, request)) {
                     log.trace("access denied due to bucket acl's");
                     // if access denied at the bucket level, no access for
                     // any of the objects so all results will be error results