gitlab-com-seaweedfs/seaweedfs
1
0
Fork 0
mirror of https://github.com/seaweedfs/seaweedfs.git synced 2024-01-19 02:48:24 +00:00
Code Issues Projects Releases Wiki Activity

https://github.com/chrislusf/seaweedfs/issues/2583

Browse source
This commit is contained in:
Konstantin Lebedev 2022-01-12 16:04:59 +05:00
parent adfd54e7c4
commit edb753ab4d
2 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
weed/s3api/auth_credentials.go
View file

@ -320,6 +320,7 @@ func (identity *Identity) canDo(action Action, bucket string, objectKey string)
return false return false
} }
target := string(action) + ":" + bucket + objectKey target := string(action) + ":" + bucket + objectKey
adminTarget := s3_constants.ACTION_ADMIN + ":" + bucket + objectKey
limitedByBucket := string(action) + ":" + bucket limitedByBucket := string(action) + ":" + bucket
adminLimitedByBucket := s3_constants.ACTION_ADMIN + ":" + bucket adminLimitedByBucket := s3_constants.ACTION_ADMIN + ":" + bucket
for _, a := range identity.Actions { for _, a := range identity.Actions {
@ -328,6 +329,9 @@ func (identity *Identity) canDo(action Action, bucket string, objectKey string)
if strings.HasPrefix(target, act[:len(act)-1]) { if strings.HasPrefix(target, act[:len(act)-1]) {
return true return true
} }
if strings.HasPrefix(adminTarget, act[:len(act)-1]) {
return true
}
} else { } else {
if act == limitedByBucket { if act == limitedByBucket {
return true return true

10
weed/s3api/auth_credentials_test.go
View file

@ -115,4 +115,14 @@ func TestCanDo(t *testing.T) {
assert.Equal(t, true, ident4.canDo(ACTION_READ, "special_bucket", "/a/b/c/d.txt")) assert.Equal(t, true, ident4.canDo(ACTION_READ, "special_bucket", "/a/b/c/d.txt"))
assert.Equal(t, false, ident4.canDo(ACTION_READ, "bucket1", "/a/b/c/d.txt")) assert.Equal(t, false, ident4.canDo(ACTION_READ, "bucket1", "/a/b/c/d.txt"))
// admin buckets
ident5 := &Identity{
Name: "anything",
Actions: []Action{
"Admin:special_*",
},
}
assert.Equal(t, true, ident5.canDo(ACTION_READ, "special_bucket", "/a/b/c/d.txt"))
assert.Equal(t, true, ident5.canDo(ACTION_WRITE, "special_bucket", "/a/b/c/d.txt"))
} }