Authorization header not validated against secret on objectstore

I'm wondering about this bug..

We clearly do check the signature in the line just above it, so what exactly is this comment referring to? Was the comment just not removed after it had been adressed or is it referring to an RBAC ACL check that needs to be added?

Actually no.

The last paramater passed to authenticate is False, which tells authenticate not to check the signature. The reason for this from the legacy code is that authenticate was constructed to verify aws signatures and unfortunately s3 uses a completely different method for signing requests. Authenticate returns the proper user and project but does NOT currently check the signature for objectstore requests.

Authorize may need to reworked a bit because it needs a little more data for the s3 version, like content-type and md5. Docs here:

http://docs.amazonwebservices.com/AmazonS3/latest/dev/index.html?RESTAuthentication.html

I've just pushed my first revision of a fix for this. It's not ready for merge yet (I want to un-spaghettify it, possibly remove the dependency on boto and add unit tests), but I'm not feeling too good today, and will be away for the weekend, so I'd rather share it to avoid wasted effort for others.