[#986] tree: Skip ACL checks if basicACL mask is unset

Signed-off-by: Airat Arifullin <a.arifullin@yadro.com>
This commit is contained in:
Airat Arifullin 2024-02-15 13:59:52 +03:00
parent 88cbe2db55
commit 511a8527d9

View file

@ -77,6 +77,11 @@ func (s *Service) verifyClient(req message, cid cidSDK.ID, rawBearer []byte, op
}
basicACL := cnr.Value.BasicACL()
// Basic ACL mask can be unset, if a container operations are performed
// with strict APE checks only.
if basicACL == 0x0 {
return nil
}
if !basicACL.IsOpAllowed(op, role) {
return basicACLErr(op)