From a236b220914d9db721bcf3719848e0249ebc82b1 Mon Sep 17 00:00:00 2001 From: Maha Benzekri Date: Mon, 15 Jul 2024 10:00:23 +0200 Subject: [PATCH] processBucketPolicy fixup for objectDelete Introduced by https://github.com/scality/cloudserver/pull/5580 we now do send a requestContext with no specific resource instead of "null", which results in a policy evaluation error. As we get an implicit deny for the requestType "objectDelete", cause the processed result to be false , thus sending an empty array of objects to vault , resulting in a deny even when the policy allows the action on specific objects. Linked Issue : https://scality.atlassian.net/browse/CLDSRV-555 --- lib/api/multiObjectDelete.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/api/multiObjectDelete.js b/lib/api/multiObjectDelete.js index cded9bb451..118b67cdee 100644 --- a/lib/api/multiObjectDelete.js +++ b/lib/api/multiObjectDelete.js @@ -398,7 +398,7 @@ function multiObjectDelete(authInfo, request, log, callback) { return next(errors.NoSuchBucket); } if (!isBucketAuthorized(bucketMD, 'objectDelete', canonicalID, authInfo, log, request, - request.actionImplicitDenies)) { + false)) { log.trace("access denied due to bucket acl's"); // if access denied at the bucket level, no access for // any of the objects so all results will be error results