From d39ce6d8e943b7a04bd587650e6f6b61944fbff9 Mon Sep 17 00:00:00 2001 From: gatewayJ <835269233@qq.com> Date: Tue, 23 Sep 2025 09:49:41 +0800 Subject: [PATCH] fix: correct DeleteObjectVersionAction (#574) Co-authored-by: loverustfs <155562731+loverustfs@users.noreply.github.com> --- rustfs/src/storage/access.rs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/rustfs/src/storage/access.rs b/rustfs/src/storage/access.rs index c2497a892..58607137a 100644 --- a/rustfs/src/storage/access.rs +++ b/rustfs/src/storage/access.rs @@ -50,9 +50,9 @@ pub async fn authorize_request(req: &mut S3Request, action: Action) -> S3R let claims = cred.claims.as_ref().unwrap_or(&default_claims); let conditions = get_condition_values(&req.headers, cred); - if action != Action::S3Action(S3Action::DeleteObjectAction) + if action == Action::S3Action(S3Action::DeleteObjectAction) && req_info.version_id.is_some() - && iam_store + && !iam_store .is_allowed(&Args { account: &cred.access_key, groups: &cred.groups, @@ -66,7 +66,7 @@ pub async fn authorize_request(req: &mut S3Request, action: Action) -> S3R }) .await { - return Ok(()); + return Err(s3_error!(AccessDenied, "Access Denied")); } if iam_store