From 2ac75018a14a22b61cfc68bc66b4f82a981a4838 Mon Sep 17 00:00:00 2001
From: Alex Auvolat <alex@adnab.me>
Date: Mon, 12 Dec 2022 12:03:54 +0100
Subject: Properly enforce allow_create_bucket

---
 src/api/s3/bucket.rs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/api/s3/bucket.rs b/src/api/s3/bucket.rs
index 3ac6a6ec..8471385f 100644
--- a/src/api/s3/bucket.rs
+++ b/src/api/s3/bucket.rs
@@ -161,6 +161,15 @@ pub async fn handle_create_bucket(
 			return Err(CommonError::BucketAlreadyExists.into());
 		}
 	} else {
+		// Check user is allowed to create bucket
+		if !key_params.allow_create_bucket.get() {
+			return Err(CommonError::Forbidden(format!(
+				"Access key {} is not allowed to create buckets",
+				api_key.key_id
+			))
+			.into());
+		}
+
 		// Create the bucket!
 		if !is_valid_bucket_name(&bucket_name) {
 			return Err(Error::bad_request(format!(
-- 
cgit v1.2.3