Harshavardhana c2ed1347d9 Do not list objects unless specified in policy (#6970) ...

Currently we use GetObject to check if we are allowed to list,
this might be a security problem since there are many users now
who actively disable a publicly readable listing, anyone who
can guess the browser URL can list the objects.

This PR turns off this behavior and provides a more expected way
based on the policies.

This PR also additionally improves the Download() object
implementation to use a more streamlined code.

These are precursor changes to facilitate federation and web
identity support in browser.

2018-12-14 09:45:09 +05:30

54 KiB

Raw Blame History

View Raw