From d91853a38b299c1132b67081b838569560103dae Mon Sep 17 00:00:00 2001 From: Maha Benzekri Date: Mon, 15 Jul 2024 10:00:23 +0200 Subject: [PATCH] processBucketPolicy fixup for objectDelete Introduced by https://github.com/scality/cloudserver/pull/5580 we now do send a requestContext with no specific resource instead of "null", which results in a policy evaluation error. As we get an implicit deny for the requestType "objectDelete", cause the processed result to be false , thus sending an empty array of objects to vault , resulting in a deny even when the policy allows the action on specific objects. Linked Issue : https://scality.atlassian.net/browse/CLDSRV-555 --- lib/api/multiObjectDelete.js | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/api/multiObjectDelete.js b/lib/api/multiObjectDelete.js index cded9bb451..512abe59df 100644 --- a/lib/api/multiObjectDelete.js +++ b/lib/api/multiObjectDelete.js @@ -397,8 +397,9 @@ function multiObjectDelete(authInfo, request, log, callback) { if (bucketShield(bucketMD, 'objectDelete')) { return next(errors.NoSuchBucket); } - if (!isBucketAuthorized(bucketMD, 'objectDelete', canonicalID, authInfo, log, request, - request.actionImplicitDenies)) { + // The implicit deny flag is ignored in the DeleteObjects API, as authorization only + // affects the objects. + if (!isBucketAuthorized(bucketMD, 'objectDelete', canonicalID, authInfo, log, request)) { log.trace("access denied due to bucket acl's"); // if access denied at the bucket level, no access for // any of the objects so all results will be error results