From 2ead90d31bd713b3b36812ed718bd44e28e522d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=AE=89=E6=AD=A3=E8=B6=85?= <anzhengchao@gmail.com>
Date: Thu, 11 Jun 2026 13:50:14 +0800
Subject: [PATCH] fix(security): add authorization check to
 ListRemoteTargetHandler (GHSA-796f-j7xp-hwf4) (#3346)

fix(security): add authorization check to ListRemoteTargetHandler

ListRemoteTargetHandler only verified that request credentials existed
but did not check whether the caller has replication or administrator
permissions. This allowed any authenticated user to list remote
replication target configuration, potentially leaking remote target
credentials (accessKey, secretKey, sessionToken).

Add validate_replication_admin_request() call with
GetBucketTargetAction, consistent with the other replication admin
handlers that already perform this check.

Fixes: GHSA-796f-j7xp-hwf4

Co-authored-by: houseme <housemecn@gmail.com>