kevinveenbirkenbachandClaude Opus 5.5 3b4ac40df5 fix(web-app-seaweedfs): deny unsigned reads on non-public consumer buckets ...

SeaweedFS 4.49+ honours a public-read object or bucket ACL on an unsigned
GET/HEAD/list even in a bucket the platform treats as private
(seaweedfs/seaweedfs#11605). Since consumers hold WriteAcp, an app could
expose objects through the public S3 API domain just by sending
x-amz-acl: public-read.

Put a bucket policy on every non-public consumer bucket that denies
s3:Get* and s3:List* to principal "*" when aws:username is null. SeaweedFS
evaluates that deny before any AllUsers grant; signed and presigned
requests carry an IAM user ARN, so aws:username is set and they are not
affected. Public buckets keep their anonymous Read grant, and a bucket
that turns public gets our deny lifted again. Embedded sidecars publish
no port and are left as they are.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-27 13:46:17 +01:00

..

action

Merge remote-tracking branch 'upstream/main' into feature/svc-net-wireguard

2026-10-17 09:34:00 +02:00

filter

fix(web-app-seaweedfs): deny unsigned reads on non-public consumer buckets

2026-10-27 13:46:17 +01:00

lookup

fix(web-app-bigbluebutton): run BBB v3.0.39 with the shared-notes server

2026-10-22 16:56:48 +02:00

__init__.py

…