From 240fab285ceac7ccbea18283c54f3d78549d2f97 Mon Sep 17 00:00:00 2001 From: Vinayakswami Hariharmath Date: Wed, 29 Jan 2025 12:14:53 +0530 Subject: [PATCH] Return 405 for Get/Head Specific Delete-Marker If the specified version in the request is a delete marker the returned is 405 Method Not Allowed. Fixes: https://github.com/noobaa/noobaa-core/issues/8369 Signed-off-by: Vinayakswami Hariharmath --- src/server/object_services/object_server.js | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/server/object_services/object_server.js b/src/server/object_services/object_server.js index 8fb40ba883..0fe4f95e0e 100644 --- a/src/server/object_services/object_server.js +++ b/src/server/object_services/object_server.js @@ -1568,6 +1568,12 @@ function get_obj_id(req, rpc_code) { * @param {string} rpc_code */ function check_object_mode(req, obj, rpc_code) { + if (obj && obj.delete_marker && req.rpc_params.version_id) { + throw new RpcError('METHOD_NOT_ALLOWED', + 'Method not allowed, delete object id of entry delete marker', + { last_modified: obj.last_modified_time, delete_marker: true }); + } + if (!obj || obj.deleted || obj.delete_marker) { throw new RpcError(rpc_code, `No such object: obj_id ${req.rpc_params.obj_id} bucket ${req.rpc_params.bucket} key ${req.rpc_params.key}`);