#4745 S3 storage: option to disable ACL, logging

inc/classes/BxDolStorageS3.php

@@ -51,6 +51,7 @@ class BxDolStorageS3 extends BxDolStorage
         );
         if ($this->_bSSL && getParam('sys_curl_ssl_allow_untrusted'))
              $this->_s3->setSSL($this->_bSSL, false);
+        $this->_s3->setExceptions(true);
     }
 
     /**
@@ -121,68 +122,77 @@ class BxDolStorageS3 extends BxDolStorage
     public function setFilePrivate($iFileId, $isPrivate = true)
     {
         $aFile = $this->_oDb->getFileById($iFileId);
-        $sFileLocation = $this->getObjectBaseDir($aFile['private']) . $aFile['path'];
-        if (($aACP = $this->_s3->getAccessControlPolicy($this->_sBucket, $sFileLocation)) === false) {
-            $this->setErrorCode(BX_DOL_STORAGE_ERR_ENGINE_GET);
+        if (!$aFile)
             return false;
-        }
 
-        if (!is_array($aACP['acl']) || !$aACP['acl']) {
-            $this->setErrorCode(BX_DOL_STORAGE_ERR_ENGINE_GET);
-            return false;
-        }
+        try {
+            $sFileLocation = $this->getObjectBaseDir($aFile['private']) . $aFile['path'];
+            if (($aACP = $this->_s3->getAccessControlPolicy($this->_sBucket, $sFileLocation)) === false) {
+                $this->setErrorCode(BX_DOL_STORAGE_ERR_ENGINE_GET);
+                return false;
+            }
 
-        // check current permissions
-        $aNewACP = $aACP;
-        unset($aNewACP['acl']);
-        $aNewACP['acl'] = array();
-        $aGroupPublic = false;
-        $aGroupPrivate = false;
-        foreach ($aACP['acl'] as $r) {
-            if ('Group' == $r['type']) {
-                if (isset($r['uri']) && $r['uri'] == 'http://acs.amazonaws.com/groups/global/AllUsers')
-                    $aGroupPublic = $r;
-                elseif (isset($r['uri']) && $r['uri'] == 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers')
-                    $aGroupPrivate = $r;
-                else
+            if (!is_array($aACP['acl']) || !$aACP['acl']) {
+                $this->setErrorCode(BX_DOL_STORAGE_ERR_ENGINE_GET);
+                return false;
+            }
+
+            // check current permissions
+            $aNewACP = $aACP;
+            unset($aNewACP['acl']);
+            $aNewACP['acl'] = array();
+            $aGroupPublic = false;
+            $aGroupPrivate = false;
+            foreach ($aACP['acl'] as $r) {
+                if ('Group' == $r['type']) {
+                    if (isset($r['uri']) && $r['uri'] == 'http://acs.amazonaws.com/groups/global/AllUsers')
+                        $aGroupPublic = $r;
+                    elseif (isset($r['uri']) && $r['uri'] == 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers')
+                        $aGroupPrivate = $r;
+                    else
+                        $aNewACP['acl'][] = $r;
+                } else {
                     $aNewACP['acl'][] = $r;
-            } else {
-                $aNewACP['acl'][] = $r;
+                }
             }
-        }
 
-        // determine permissions changing
+            // determine permissions changing
 
-        $aGroupAdd = false;
+            $aGroupAdd = false;
 
-        if ($isPrivate && (!$aGroupPrivate || $aGroupPublic)) {
+            if ($isPrivate && (!$aGroupPrivate || $aGroupPublic)) {
 
-            // make private
-            $aGroupAdd = array (
-                    'type' => 'Group',
-                    'uri' => 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers',
-                    'permission' => 'READ',
-                );
+                // make private
+                $aGroupAdd = array (
+                        'type' => 'Group',
+                        'uri' => 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers',
+                        'permission' => 'READ',
+                    );
 
-        } elseif (!$isPrivate && ($aGroupPrivate || !$aGroupPublic)) {
+            } elseif (!$isPrivate && ($aGroupPrivate || !$aGroupPublic)) {
 
-            // make public
-            $aGroupAdd = array (
-                    'type' => 'Group',
-                    'uri' => 'http://acs.amazonaws.com/groups/global/AllUsers',
-                    'permission' => 'READ',
-                );
+                // make public
+                $aGroupAdd = array (
+                        'type' => 'Group',
+                        'uri' => 'http://acs.amazonaws.com/groups/global/AllUsers',
+                        'permission' => 'READ',
+                    );
 
-        }
+            }
 
-        // change permission if necessary
+            // change permission if necessary
 
-        if ($aGroupAdd) {
-            $aNewACP['acl'][] = $aGroupAdd;
-            if (!$this->_s3->setAccessControlPolicy($this->_sBucket, $sFileLocation, $aNewACP)) {
-                $this->setErrorCode(BX_DOL_STORAGE_ERR_ENGINE_GET);
-                return false;
+            if ($aGroupAdd) {
+                $aNewACP['acl'][] = $aGroupAdd;
+                if (!$this->_s3->setAccessControlPolicy($this->_sBucket, $sFileLocation, $aNewACP)) {
+                    $this->setErrorCode(BX_DOL_STORAGE_ERR_ENGINE_GET);
+                    return false;
+                }
             }
+        } catch (Exception $e) {
+            $this->setErrorCode(BX_DOL_STORAGE_ERR_ENGINE_GET);
+            bx_log('sys_storage_s3', $e->getMessage());
+            return false;
         }
 
         return parent::setFilePrivate($iFileId, $isPrivate);
@@ -209,18 +219,24 @@ class BxDolStorageS3 extends BxDolStorage
 
     protected function addFileToEngine($sTmpFile, $sLocalId, $sName, $isPrivate, $iProfileId)
     {
-        $sMimeType = $this->getMimeTypeByFileName($sName);
-        $sExt = $this->getFileExt($sName);
-        $sPath = $this->genPath($sLocalId, $this->_aObject['levels']);
-        $sRemoteNamePath = $sPath . $sLocalId . ($sExt ? '.' . $sExt : '');
-        $aRequestHeaders = $this->generateHeaders($sName, $isPrivate);
-        $aMetaHeaders = array();
-
-        $sStorageClass = $this->_bReducedRedundancy ? S3::STORAGE_CLASS_RRS : S3::STORAGE_CLASS_STANDARD;
-        $sACL = $isPrivate ? S3::ACL_AUTHENTICATED_READ : S3::ACL_PUBLIC_READ;
-        $aInputFile = $this->_s3->inputFile($sTmpFile);
-        if (!$this->_s3->putObject($aInputFile, $this->_sBucket, $this->getObjectBaseDir($isPrivate) . $sRemoteNamePath, $sACL, $aMetaHeaders, $aRequestHeaders, $sStorageClass)) {
+        try {
+            $sMimeType = $this->getMimeTypeByFileName($sName);
+            $sExt = $this->getFileExt($sName);
+            $sPath = $this->genPath($sLocalId, $this->_aObject['levels']);
+            $sRemoteNamePath = $sPath . $sLocalId . ($sExt ? '.' . $sExt : '');
+            $aRequestHeaders = $this->generateHeaders($sName, $isPrivate);
+            $aMetaHeaders = array();
+
+            $sStorageClass = $this->_bReducedRedundancy ? S3::STORAGE_CLASS_RRS : S3::STORAGE_CLASS_STANDARD;
+            $sACL = $isPrivate ? S3::ACL_AUTHENTICATED_READ : S3::ACL_PUBLIC_READ;
+            $aInputFile = $this->_s3->inputFile($sTmpFile);
+            if (!$this->_s3->putObject($aInputFile, $this->_sBucket, $this->getObjectBaseDir($isPrivate) . $sRemoteNamePath, $sACL, $aMetaHeaders, $aRequestHeaders, $sStorageClass)) {
+                $this->setErrorCode(BX_DOL_STORAGE_ERR_ENGINE_ADD);
+                return false;
+            }
+        } catch (Exception $e) {
             $this->setErrorCode(BX_DOL_STORAGE_ERR_ENGINE_ADD);
+            bx_log('sys_storage_s3', $e->getMessage());
             return false;
         }
 
@@ -231,8 +247,14 @@ class BxDolStorageS3 extends BxDolStorage
     {
         $sFileLocation = $this->getObjectBaseDir($isPrivate) . $sFilePath;
 
-        if (!$this->_s3->deleteObject($this->_sBucket, $sFileLocation)) {
+        try {
+            if (!$this->_s3->deleteObject($this->_sBucket, $sFileLocation)) {
+                $this->setErrorCode(BX_DOL_STORAGE_ERR_UNLINK);
+                return false;
+            }
+        } catch (Exception $e) {
             $this->setErrorCode(BX_DOL_STORAGE_ERR_UNLINK);
+            bx_log('sys_storage_s3', $e->getMessage());
             return false;
         }
 

inc/classes/BxDolStorageS3v4.php

@@ -26,6 +26,7 @@ class BxDolStorageS3v4 extends BxDolStorageS3
         );
         if ($this->_bSSL && getParam('sys_curl_ssl_allow_untrusted'))
              $this->_s3->setSSL($this->_bSSL, false);
+        $this->_s3->setExceptions(true);
     }
 }
 

inc/classes/BxDolStorageS3v4alt.php

@@ -87,6 +87,9 @@ class BxDolStorageS3v4alt extends BxDolStorageS3
         if (!$aFile)
             return false;
 
+        if (!getParam('sys_storage_s3_acl_enable'))
+            return parent::setFilePrivate($iFileId, 0);
+
         $sFileLocation = $this->getObjectBaseDir($aFile['private']) . $aFile['path'];
         
         $sTmpFile = tempnam(BX_DIRECTORY_PATH_TMP, $this->_aObject['object']);
@@ -104,7 +107,10 @@ class BxDolStorageS3v4alt extends BxDolStorageS3
             return false;
         }
 
-        $sACL = $isPrivate ? Akeeba\Engine\Postproc\Connector\S3v4\Acl::ACL_AUTHENTICATED_READ : Akeeba\Engine\Postproc\Connector\S3v4\Acl::ACL_PUBLIC_READ;
+        if (getParam('sys_storage_s3_acl_enable'))
+            $sACL = $isPrivate ? Akeeba\Engine\Postproc\Connector\S3v4\Acl::ACL_AUTHENTICATED_READ : Akeeba\Engine\Postproc\Connector\S3v4\Acl::ACL_PUBLIC_READ;
+        else
+            $sACL = '';
         $aRequestHeaders = $this->generateHeaders('', $isPrivate, $aFile['mime_type']);
         if (!$this->_upload($sTmpFile, $sFileLocation, $sACL, $aRequestHeaders))
             return false;
@@ -120,8 +126,10 @@ class BxDolStorageS3v4alt extends BxDolStorageS3
         $sPath = $this->genPath($sLocalId, $this->_aObject['levels']);
         $sRemoteNamePath = $sPath . $sLocalId . ($sExt ? '.' . $sExt : '');
         $aRequestHeaders = $this->generateHeaders($sName, $isPrivate);
-        $sACL = $isPrivate ? Akeeba\Engine\Postproc\Connector\S3v4\Acl::ACL_AUTHENTICATED_READ : Akeeba\Engine\Postproc\Connector\S3v4\Acl::ACL_PUBLIC_READ;
-
+        if (getParam('sys_storage_s3_acl_enable'))
+            $sACL = $isPrivate ? Akeeba\Engine\Postproc\Connector\S3v4\Acl::ACL_AUTHENTICATED_READ : Akeeba\Engine\Postproc\Connector\S3v4\Acl::ACL_PUBLIC_READ;
+        else
+            $sACL = '';
         return $this->_upload($sTmpFile, $this->getObjectBaseDir($isPrivate) . $sRemoteNamePath, $sACL, $aRequestHeaders);
     }
 

install/sql/system.sql

@@ -609,7 +609,8 @@ INSERT INTO `sys_options`(`category_id`, `name`, `caption`, `value`, `type`, `ex
 (@iCategoryId, 'sys_storage_s3_endpoint', '_adm_stg_cpt_option_sys_storage_s3_endpoint', '', 'digit', '', '', '', 6),
 (@iCategoryId, 'sys_storage_s3_sig_ver', '_adm_stg_cpt_option_sys_storage_s3_sig_ver', 'v2', 'select', 'v2,v4', '', '', 7),
 (@iCategoryId, 'sys_storage_s3_region', '_adm_stg_cpt_option_sys_storage_s3_region', '', 'digit', '', '', '', 8),
-(@iCategoryId, 'sys_storage_s3_amz_iam_role', '_adm_stg_cpt_option_sys_storage_s3_amz_iam_role', '', 'checkbox', '', '', '', 10);
+(@iCategoryId, 'sys_storage_s3_amz_iam_role', '_adm_stg_cpt_option_sys_storage_s3_amz_iam_role', '', 'checkbox', '', '', '', 10),
+(@iCategoryId, 'sys_storage_s3_acl_enable', '_adm_stg_cpt_option_sys_storage_s3_acl_enable', 'on', 'checkbox', '', '', '', 12);
 --
 -- CATEGORY: Account
 --

modules/boonex/english/data/langs/system/en.xml

@@ -1691,6 +1691,7 @@
 	<string name="_adm_stg_cpt_option_sys_storage_s3_sig_ver"><![CDATA[Signature version (only S3v4alt storage supports both v2 and v4)]]></string>
 	<string name="_adm_stg_cpt_option_sys_storage_s3_region"><![CDATA[Region (for signature v4 only)]]></string>
     <string name="_adm_stg_cpt_option_sys_storage_s3_amz_iam_role"><![CDATA[Authenticate using Amazon  IAM Role (S3v4alt storage only)]]></string>
+    <string name="_adm_stg_cpt_option_sys_storage_s3_acl_enable"><![CDATA[Enable ACLs (S3v4alt storage only)]]></string>
 
     <string name="_adm_stg_cpt_option_sys_template_cache_image_enable"><![CDATA[Enable cache for images]]></string>
     <string name="_adm_stg_cpt_option_sys_template_cache_image_max_size"><![CDATA[Cached image max size (in Kb)]]></string>

modules/boonex/russian/data/langs/system/ru.xml

@@ -1666,6 +1666,7 @@
 	<string name="_adm_stg_cpt_option_sys_storage_s3_sig_ver"><![CDATA[Версия подписи (только S3v4alt движок поддерживает обе версии v4 и v2)]]></string>
 	<string name="_adm_stg_cpt_option_sys_storage_s3_region"><![CDATA[Регион (только для подписи v4)]]></string>
     <string name="_adm_stg_cpt_option_sys_storage_s3_amz_iam_role"><![CDATA[Аутентификация с использованием Amazon IAM Role (только для S3v4alt)]]></string>
+    <string name="_adm_stg_cpt_option_sys_storage_s3_acl_enable"><![CDATA[Включить ACLs (только для S3v4alt)]]></string>
 
     <string name="_adm_stg_cpt_option_sys_template_cache_image_enable"><![CDATA[Задействовать кэш для изображений]]></string>
     <string name="_adm_stg_cpt_option_sys_template_cache_image_max_size"><![CDATA[Максимальный размер кэшируемого изображения (в Кб)]]></string>