Merge branch 'bugfix/CLDSRV-555-deleteObjects-policy-eval-fix' into t…

…mp/octopus/w/7.70/bugfix/CLDSRV-555-deleteObjects-policy-eval-fix
scality · Jul 15, 2024 · e139406 · e139406
2 parents ab2960b + d91853a
commit e139406
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/lib/api/multiObjectDelete.js b/lib/api/multiObjectDelete.js
@@ -500,8 +500,9 @@ function multiObjectDelete(authInfo, request, log, callback) {
                 if (bucketShield(bucketMD, 'objectDelete')) {
                     return next(errors.NoSuchBucket);
                 }
-                if (!isBucketAuthorized(bucketMD, 'objectDelete', canonicalID, authInfo, log, request,
-                    request.actionImplicitDenies)) {
+                // The implicit deny flag is ignored in the DeleteObjects API, as authorization only
+                // affects the objects.
+                if (!isBucketAuthorized(bucketMD, 'objectDelete', canonicalID, authInfo, log, request)) {
                     log.trace("access denied due to bucket acl's");
                     // if access denied at the bucket level, no access for
                     // any of the objects so all results will be error results