add encoded filename as part of delete api url

[prakashsvmx]

@cesnietor , @poornas

Console has different API (endpoint) urls for different scenarios to handle deletes.

the below url is modified to pass filename in case of single object delete, in url params

http://localhost:5005/api/v1/buckets/test-v-bucket/objects?prefix=MS50eHQ%3D&non_current_versions=true&bypass=false

Context, this is done so that we can do special operations with apis that have the prefix defined. single objects where being sent in the array so a single delete object api was needed.

[cesnietor]

I see what you are saying @prakashsvmx .
Humm here let's consider a multiple object call only those that delete different object names, i.e. if it's a single file with multiple versions to be deleted (due to a versioned bucket), that for us is still a single delete call, with the all-versions enabled.

so here we don't need to do any changes to the /delete-objects call but rather have a separate one for single-object delete. so that we can plug the name and the path in the prefix param. In the UI if multiple files are selected then we use the /delete-objects, if it's a single file we just use the new one.

[prakashsvmx]

@cesnietor
the single delete is already implemented as part of http://localhost:5005/api/v1/buckets/{bucket_name}/objects API endpoint with DELETE method.

so i have renamed path to prefix to be consistent everywhere. and updated all single deletes to use this endpoint.

@poornas @kannappanr

[cesnietor]

@cesnietor the single delete is already implemented as part of http://localhost:5005/api/v1/buckets/{bucket_name}/objects API endpoint with DELETE method.

so i have renamed path to prefix to be consistent everywhere. and updated all single deletes to use this endpoint.

@poornas @kannappanr

Ahh awesome, thanks.

[allanrogerr]

@prakashsvmx Please check
Vulnerability #1: GO-2023-2382
Vulnerability #2: GO-2023-21

[cesnietor]

@allanrogerr vulns are unrelated to this change. They've been there for a while. We'll have to address them separately.

[allanrogerr]

@allanrogerr vulns are unrelated to this change. They've been there for a while. We'll have to address them separately.

Thats unfortunate. Vulnerabilities should take some priority IMO.

[allanrogerr]

@prakashsvmx Will encoding the filename of multiple objects be addressed in a followup PR? That is encoding the files name of the payload of api/v1/buckets/<bucket-name>/delete-objects ?

[allanrogerr]

Tested. Please consider fixing vulnerabilities.

[bexsoft]

Tested. Please consider fixing vulnerabilities.

Fixed in #3146

[cesnietor]

@prakashsvmx Will encoding the filename of multiple objects be addressed in a followup PR? That is encoding the files name of the payload of api/v1/buckets//delete-objects ?

for multiple files we send them in the payload, so no need to encode them @allanrogerr

[cesnietor]

tested LGTM