From bce3f8237db54a397240ff2e760ee42a359b6afc Mon Sep 17 00:00:00 2001 From: Harshavardhana Date: Mon, 15 Jul 2019 12:00:41 -0700 Subject: [PATCH] Allow users to give anonymous access (#7926) Current code already allows users to GetPolicy/SetPolicy there was a missing code in ListAllBucketPolicies to allow access, this fixes this behavior. Fixes #7913 --- cmd/web-handlers.go | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/cmd/web-handlers.go b/cmd/web-handlers.go index 8121e79ae..d7c59fc9a 100644 --- a/cmd/web-handlers.go +++ b/cmd/web-handlers.go @@ -1491,6 +1491,7 @@ func (web *webAPIHandlers) GetBucketPolicy(r *http.Request, args *GetBucketPolic if authErr != nil { return toJSONError(ctx, authErr) } + // For authenticated users apply IAM policy. if !globalIAMSys.IsAllowed(iampolicy.Args{ AccountName: claims.Subject, @@ -1583,12 +1584,19 @@ func (web *webAPIHandlers) ListAllBucketPolicies(r *http.Request, args *ListAllB return toJSONError(ctx, errServerNotInitialized) } - _, owner, authErr := webRequestAuthenticate(r) + claims, owner, authErr := webRequestAuthenticate(r) if authErr != nil { return toJSONError(ctx, authErr) } - if !owner { + // For authenticated users apply IAM policy. + if !globalIAMSys.IsAllowed(iampolicy.Args{ + AccountName: claims.Subject, + Action: iampolicy.GetBucketPolicyAction, + BucketName: args.BucketName, + ConditionValues: getConditionValues(r, "", claims.Subject), + IsOwner: owner, + }) { return toJSONError(ctx, errAccessDenied) }