mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-29 00:10:42 +01:00
Jay Hemnani
5c14e566bc
checkAccessByOwnership compared the caller's account with the bucket owner even with no identities configured, so Get/Put/Delete BucketOwnershipControls answered AccessDenied to every request. With auth off there is no owner to compare against, as the other auth-off checks already assume.
38 lines
974 B
Go
38 lines
974 B
Go
package s3api
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
|
|
)
|
|
|
|
func getAccountId(r *http.Request) string {
|
|
id := r.Header.Get(s3_constants.AmzAccountId)
|
|
if len(id) == 0 {
|
|
return AccountAnonymous.Id
|
|
} else {
|
|
return id
|
|
}
|
|
}
|
|
|
|
func (s3a *S3ApiServer) checkAccessByOwnership(r *http.Request, bucket string) s3err.ErrorCode {
|
|
metadata, errCode := s3a.bucketRegistry.GetBucketMetadata(bucket)
|
|
if errCode != s3err.ErrNone {
|
|
return errCode
|
|
}
|
|
// Without auth there is no owner to compare against.
|
|
if s3a.iam != nil && !s3a.iam.isEnabled() {
|
|
return s3err.ErrNone
|
|
}
|
|
// Admin by capability, not account id: account-less identities share the "admin" id.
|
|
if s3a.isUserAdmin(r) {
|
|
return s3err.ErrNone
|
|
}
|
|
accountId := getAccountId(r)
|
|
if metadata.Owner != nil && metadata.Owner.ID != nil && accountId == *metadata.Owner.ID {
|
|
return s3err.ErrNone
|
|
}
|
|
return s3err.ErrAccessDenied
|
|
}
|