rgw: load copy source bucket attrs in putobj

PutObj is not loading the source bucket's attrs, which prevents
the associated policies from being loaded. As a result, the
permissions granted to the user to read from the source bucket are
not being properly evaluated.

Fixes: https://tracker.ceph.com/issues/67590
Signed-off-by: Seena Fallah <seenafallah@gmail.com>
(cherry picked from commit 8a71aea942d2c59e42721eac0ca931cac1054d84)

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 8d95fee080ce7c2948d12905e52fef6ac57be9dd..04a55ccc8ff2670d2dde8eb9e535988559d5698a 100644 (file)
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -3644,6 +3644,7 @@ int RGWPutObj::init_processing(optional_yield y) {
       return ret;
     }
     copy_source_bucket_info = bucket->get_info();
+    copy_source_bucket_attrs = bucket->get_attrs();
 
     /* handle x-amz-copy-source-range */
     if (copy_source_range) {
@@ -3689,7 +3690,6 @@ int RGWPutObj::verify_permission(optional_yield y)
 
     RGWAccessControlPolicy cs_acl(s->cct);
     boost::optional<Policy> policy;
-    map<string, bufferlist> cs_attrs;
     std::unique_ptr<rgw::sal::Bucket> cs_bucket;
     int ret = driver->get_bucket(NULL, copy_source_bucket_info, &cs_bucket);
     if (ret < 0)
@@ -3702,7 +3702,7 @@ int RGWPutObj::verify_permission(optional_yield y)
     cs_object->set_prefetch_data();
 
     /* check source object permissions */
-    if (ret = read_obj_policy(this, driver, s, copy_source_bucket_info, cs_attrs, &cs_acl, nullptr,
+    if (ret = read_obj_policy(this, driver, s, copy_source_bucket_info, copy_source_bucket_attrs, &cs_acl, nullptr,
                        policy, cs_bucket.get(), cs_object.get(), y, true); ret < 0) {
       return ret;
     }

diff --git a/src/rgw/rgw_op.h b/src/rgw/rgw_op.h
index 16d894f3d09caac713691706a423892611750e9b..1474d7720fb342a235ea5074a8f9e54a489cc8f6 100644 (file)
--- a/src/rgw/rgw_op.h
+++ b/src/rgw/rgw_op.h
@@ -1200,6 +1200,7 @@ protected:
   std::string copy_source;
   const char *copy_source_range;
   RGWBucketInfo copy_source_bucket_info;
+  rgw::sal::Attrs copy_source_bucket_attrs;
   std::string copy_source_tenant_name;
   std::string copy_source_bucket_name;
   std::string copy_source_object_name;