niksis02 8d5b2be0b2 fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload ...

Fixes #1986

When a client includes tagging, legal hold, or retention headers in a PutObject, CopyObject or CreateMultipartUpload request, the corresponding bucket policy permissions must be verified in addition to s3:PutObject:

`X-Amz-Tagging` - `s3:PutObjectTagging`
`X-Amz-Object-Lock-Legal-Hold` - `s3:PutObjectLegalHold`
`X-Amz-Object-Lock-Mode` - `s3:PutObjectRetention`

Previously, only s3:PutObject was checked, allowing users to set tagging, legal hold, and retention without having the required permissions. Now each action permission is check, if user tries to add them.

For CopyObject these permissions are checked on destination object.

2026-04-28 01:05:34 +04:00

..

AbortMultipartUpload.go

chore: fix spellings and unused function args

2026-04-15 10:32:14 -07:00

Access_Control.go

fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload

2026-04-28 01:05:34 +04:00

bench.go

chore: run go modernize tool

2026-03-10 09:47:37 -07:00

CompleteMultipartUpload.go

fix: make CompleteMultipartUpload idempotent and add part-number support to GetObject/HeadObject

2026-04-20 20:45:58 +04:00

concurrency.go

test: add github actions functional tests for posix sidecar option

2026-04-22 13:23:46 -07:00

CopyObject.go

feat: implement x-amz-source-expected-bucket-owner for CopyObject and UploadPartCopy

2026-04-01 21:44:33 +04:00

CreateBucket.go

feat: adds Location, x-amz-bucket-arn response headers in CreateBucket

2026-02-20 13:02:51 +04:00

CreateMultipartUpload.go

Merge pull request #1931 from versity/sis/object-metadata-limits

2026-03-06 13:17:14 -08:00

data-io.go

chore: add missing copyright headers to files

2024-05-06 16:16:31 -07:00

DeleteBucket.go

feat: adds Location, x-amz-bucket-arn response headers in CreateBucket

2026-02-20 13:02:51 +04:00

DeleteBucketCors.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteBucketOwnershipControls.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteBucketPolicy.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteBucketTagging.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteObject.go

fix: fixes DeleteObject if-match quoted comparison

2026-02-11 16:45:36 +04:00

DeleteObjects.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteObjectTagging.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

general.go

fix: adds an error route for ?versions subresource with key

2026-01-03 16:23:11 +04:00

GetBucketAcl.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketCors.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketLocation.go

fix: return null in GetBucketLocation for us-east-1

2026-01-05 16:24:01 +04:00

GetBucketLockConfiguration.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketOwnershipControls.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketPolicy.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketPolicyStatus.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketTagging.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketVersioning.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetObject.go

fix: correct 206 Partial Content response status for ranged GetObject and HeadObject

2026-04-21 02:13:04 +04:00

GetObjectAttributes.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetObjectLegalHold.go

fix: fixes missing bucket object lock config error

2026-01-14 13:41:50 +04:00

GetObjectRetention.go

fix: fixes missing bucket object lock config error

2026-01-14 13:41:50 +04:00

GetObjectTagging.go

fix: removes the NoSuchTagSet error in GetObjecTagging

2026-01-02 23:31:35 +04:00

group-tests.go

fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload

2026-04-28 01:05:34 +04:00

HeadBucket.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

HeadObject.go

fix: correct 206 Partial Content response status for ranged GetObject and HeadObject

2026-04-21 02:13:04 +04:00

iam.go

feat: implements admin CreateBucket endpoint/cli command

2026-01-12 14:32:52 +04:00

ListBuckets.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

ListMultipartUploads.go

fix: fixes list-limiters parsing and validation

2026-02-06 14:21:56 +04:00

ListObjects.go

fix: fix azure multipart upload objects masking

2026-04-16 23:56:18 +04:00

ListObjectsV2.go

fix: fix azure multipart upload objects masking

2026-04-16 23:56:18 +04:00

ListObjectVersions.go

fix: fixes list-limiters parsing and validation

2026-02-06 14:21:56 +04:00

ListParts.go

fix: fixes list-limiters parsing and validation

2026-02-06 14:21:56 +04:00

no_acl.go

feat: revert ignore object ACL behavior

2026-03-02 19:30:57 +04:00

NotImplemented_actions.go

feat: revert ignore object ACL behavior

2026-03-02 19:30:57 +04:00

OPTIONS.go

feat: add option for default global cors allow origin headers

2026-01-08 16:23:23 -08:00

output.go

chore: run go modernize tool

2026-03-10 09:47:37 -07:00

posix.go

fix: retry link on ENOENT caused by racing DeleteObject

2026-04-02 08:14:44 -07:00

PostObject.go

fix: remove POST object multipart boundary prefix trimming

2026-04-02 17:20:23 +04:00

presigned_urls.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

public_bucket.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

PutBucketAcl.go

fix: adds validation for bucket canned ACL

2025-11-03 22:59:06 +04:00

PutBucketCors.go

fix: fixes PutBucketCors CORSRules validation

2026-02-24 16:59:38 +04:00

PutBucketOwnershipControls.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

PutBucketPolicy.go

fix: fixes the PutBucketPolicy response status

2025-12-29 21:10:52 +04:00

PutBucketTagging.go

feat: add browser-based POST object upload support

2026-03-31 22:44:54 +04:00

PutBucketVersioning.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

PutObject.go

Merge pull request #1931 from versity/sis/object-metadata-limits

2026-03-06 13:17:14 -08:00

PutObjectLegalHold.go

fix: fixes missing bucket object lock config error

2026-01-14 13:41:50 +04:00

PutObjectLockConfiguration.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

PutObjectRetention.go

fix: fixes missing bucket object lock config error

2026-01-14 13:41:50 +04:00

PutObjectTagging.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

s3conf.go

feat: replace aws-sdk-go-v2 s3 manager with transfermanager

2026-02-11 09:58:15 -08:00

server.go

fix: add request headers and metadata headers limit

2026-03-06 23:25:49 +04:00

signed_streaming_payload_trailer.go

feat: adds integration tests for STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER requests

2025-12-26 21:16:01 +04:00

signed_streaming_payload.go

feat: adds integration tests for STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER requests

2025-12-26 21:16:01 +04:00

sigv4_auth.go

feat: add browser-based POST object upload support

2026-03-31 22:44:54 +04:00

unsigned_streaming_payload_trailer.go

Merge pull request #1679 from versity/sis/unsigned-streaming-upload-not-allowed

2025-12-08 18:08:46 -08:00

UploadPart.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

UploadPartCopy.go

feat: implement x-amz-source-expected-bucket-owner for CopyObject and UploadPartCopy

2026-04-01 21:44:33 +04:00

utils.go

test: add github actions functional tests for posix sidecar option

2026-04-22 13:23:46 -07:00

versioning.go

fix: move versionId validation to backend

2026-04-07 01:56:51 +04:00

WORM_protection.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00