Merge branch 'w/8.6/bugfix/CLDSRV-555-deleteObjects-policy-eval-fix' …

…into tmp/octopus/w/8.7/bugfix/CLDSRV-555-deleteObjects-policy-eval-fix
scality · Jul 15, 2024 · 31892ee · 31892ee
2 parents d578051 + 56a688a
commit 31892ee
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/lib/api/multiObjectDelete.js b/lib/api/multiObjectDelete.js
@@ -504,8 +504,9 @@ function multiObjectDelete(authInfo, request, log, callback) {
                 if (bucketShield(bucketMD, 'objectDelete')) {
                     return next(errors.NoSuchBucket);
                 }
-                if (!isBucketAuthorized(bucketMD, 'objectDelete', canonicalID, authInfo, log, request,
-                    false)) {
+                // The implicit deny flag is ignored in the DeleteObjects API, as authorization only
+                // affects the objects.
+                if (!isBucketAuthorized(bucketMD, 'objectDelete', canonicalID, authInfo, log, request)) {
                     log.trace("access denied due to bucket acl's");
                     // if access denied at the bucket level, no access for
                     // any of the objects so all results will be error results