From ffcfa36b13e6a5b8fbdbbb3a9cfd8fa62436043f Mon Sep 17 00:00:00 2001
From: Klaus Post <klauspost@gmail.com>
Date: Fri, 8 Aug 2025 04:38:25 +0200
Subject: [PATCH] Check legalHoldPerm (#21508)

The provided parameter should be checked before accepting legal hold
---
 cmd/bucket-object-lock.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/cmd/bucket-object-lock.go b/cmd/bucket-object-lock.go
index 984dd9d47..d0ad85144 100644
--- a/cmd/bucket-object-lock.go
+++ b/cmd/bucket-object-lock.go
@@ -297,6 +297,9 @@ func checkPutObjectLockAllowed(ctx context.Context, rq *http.Request, bucket, ob
 		if legalHold, lerr = objectlock.ParseObjectLockLegalHoldHeaders(rq.Header); lerr != nil {
 			return mode, retainDate, legalHold, toAPIErrorCode(ctx, lerr)
 		}
+		if legalHoldPermErr != ErrNone {
+			return mode, retainDate, legalHold, legalHoldPermErr
+		}
 	}
 
 	if retentionRequested {