MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-01-11 15:03:22 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix: Disable presigned without appropriate policy (#9621)

Browse Source 
Fixes #9590
This commit is contained in:
Harshavardhana 2020-05-17 23:38:52 -07:00 committed by GitHub
parent a62572fb86
commit de9b391db3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cmd/jwt.go
View File

@ -47,6 +47,7 @@ var (
errAuthentication = errors.New("Authentication failed, check your access credentials")
errNoAuthToken = errors.New("JWT token missing")
errIncorrectCreds = errors.New("Current access key or secret key is incorrect")
errPresignedNotAllowed = errors.New("Unable to generate shareable URL due to lack of read permissions")
)
func authenticateJWTUsers(accessKey, secretKey string, expiry time.Duration) (string, error) {

14
cmd/web-handlers.go
View File

@ -1966,6 +1966,20 @@ func (web *webAPIHandlers) PresignedGet(r *http.Request, args *PresignedGetArgs,
return toJSONError(ctx, errInvalidBucketName)
}
// Check if the user indeed has GetObject access,
// if not we do not need to generate presigned URLs
if !globalIAMSys.IsAllowed(iampolicy.Args{
AccountName: claims.AccessKey,
Action: iampolicy.GetObjectAction,
BucketName: args.BucketName,
ConditionValues: getConditionValues(r, "", claims.AccessKey, claims.Map()),
IsOwner: owner,
ObjectName: args.ObjectName,
Claims: claims.Map(),
}) {
return toJSONError(ctx, errPresignedNotAllowed)
}
reply.UIVersion = browser.UIVersion
reply.URL = presignedGet(args.HostName, args.BucketName, args.ObjectName, args.Expiry, creds, region)
return nil