rgw: reject unauthenticated response-header actions

Signed-off-by: Matt Benjamin <mbenjamin@redhat.com>
Reviewed-by: Casey Bodley <cbodley@redhat.com>
(cherry picked from commit d8dd5e513c0c62bbd7d3044d7e2eddcd897bd400)

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index 18b1f8fd92dae7eec6633d3f1f97f42b4a8ecfbf..47df778ae072c917ef4d892ad3cc36915e7041a7 100644 (file)
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -283,6 +283,11 @@ int RGWGetObj_ObjStore_S3::send_response_data(bufferlist& bl, off_t bl_ofs,
       bool exists;
       string val = s->info.args.get(p->param, &exists);
       if (exists) {
+       /* reject unauthenticated response header manipulation, see
+        * https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html */
+       if (s->auth.identity->is_anonymous()) {
+         return -EPERM;
+       }
        if (strcmp(p->param, "response-content-type") != 0) {
          response_attrs[p->http_attr] = val;
        } else {