niksis02 8d5b2be0b2 fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload ...

Fixes #1986

When a client includes tagging, legal hold, or retention headers in a PutObject, CopyObject or CreateMultipartUpload request, the corresponding bucket policy permissions must be verified in addition to s3:PutObject:

`X-Amz-Tagging` - `s3:PutObjectTagging`
`X-Amz-Object-Lock-Legal-Hold` - `s3:PutObjectLegalHold`
`X-Amz-Object-Lock-Mode` - `s3:PutObjectRetention`

Previously, only s3:PutObject was checked, allowing users to set tagging, legal hold, and retention without having the required permissions. Now each action permission is check, if user tries to add them.

For CopyObject these permissions are checked on destination object.

2026-04-28 01:05:34 +04:00

..

admin_test.go

fix: enforce 5gb copy source object size threshold.

2026-03-31 22:44:03 +04:00

admin.go

feat: implements admin CreateBucket endpoint/cli command

2026-01-12 14:32:52 +04:00

backend_moq_test.go

feat: adds tagging support for object versions in posix

2025-11-04 23:51:22 +04:00

base_test.go

chore: fix spellings and unused function args

2026-04-15 10:32:14 -07:00

base.go

Merge pull request #1997 from versity/sis/copyobject-threshold

2026-03-31 12:27:11 -07:00

bucket-delete_test.go

fix: fixes the invalid x-amz-mp-object-size header error in CompleteMultipartUpload.

2025-07-22 21:01:32 +04:00

bucket-delete.go

fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload

2026-04-28 01:05:34 +04:00

bucket-get_test.go

fix: add x-amz-bucket-region to ListObjects(V2) response headers.

2026-04-01 15:22:33 +04:00

bucket-get.go

fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload

2026-04-28 01:05:34 +04:00

bucket-head_test.go

fix: head object should set X-Amz-Bucket-Region on access denied

2025-10-28 19:50:01 +04:00

bucket-head.go

fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload

2026-04-28 01:05:34 +04:00

bucket-list_test.go

fix: fixes list-limiters parsing and validation

2026-02-06 14:21:56 +04:00

bucket-list.go

fix: fixes list-limiters parsing and validation

2026-02-06 14:21:56 +04:00

bucket-post_test.go

feat: implement integration tests for browser-based POST object

2026-03-31 22:47:04 +04:00

bucket-post.go

fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload

2026-04-28 01:05:34 +04:00

bucket-put_test.go

feat: add browser-based POST object upload support

2026-03-31 22:44:54 +04:00

bucket-put.go

fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload

2026-04-28 01:05:34 +04:00

cors_default_origin_test.go

fix: add Host header to HTTP test requests for fasthttp v1.70.0 compatibility

2026-04-13 19:13:58 -07:00

iam_moq_test.go

feat: Added admin api and CLI command for updating gateway users attributes

2024-06-20 08:13:10 -07:00

object-delete_test.go

fix: move versionId validation to backend

2026-04-07 01:56:51 +04:00

object-delete.go

fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload

2026-04-28 01:05:34 +04:00

object-get_test.go

fix: correct 206 Partial Content response status for ranged GetObject and HeadObject

2026-04-21 02:13:04 +04:00

object-get.go

fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload

2026-04-28 01:05:34 +04:00

object-head_test.go

fix: correct 206 Partial Content response status for ranged GetObject and HeadObject

2026-04-21 02:13:04 +04:00

object-head.go

fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload

2026-04-28 01:05:34 +04:00

object-post_test.go

fix: add request headers and metadata headers limit

2026-03-06 23:25:49 +04:00

object-post.go

fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload

2026-04-28 01:05:34 +04:00

object-put_test.go

fix: move versionId validation to backend

2026-04-07 01:56:51 +04:00

object-put.go

fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload

2026-04-28 01:05:34 +04:00

options_test.go

fix: fixes PutBucketCors CORSRules validation

2026-02-24 16:59:38 +04:00

options.go

cleanup: move debuglogger to top level for full project access

2025-09-01 20:02:02 -07:00