diff --git a/code/go/0chain.net/blobbercore/handler/object_operation_handler.go b/code/go/0chain.net/blobbercore/handler/object_operation_handler.go index 98a8b6c9c..83da7ec77 100644 --- a/code/go/0chain.net/blobbercore/handler/object_operation_handler.go +++ b/code/go/0chain.net/blobbercore/handler/object_operation_handler.go @@ -427,22 +427,22 @@ func (fsh *StorageHandler) CreateConnection(ctx context.Context, r *http.Request return nil, common.NewError("invalid_parameters", "Invalid allocation id passed."+err.Error()) } - if !allocationObj.CanRename() { - return nil, common.NewError("prohibited_allocation_file_options", "Cannot rename data in this allocation.") - } - clientID := ctx.Value(constants.ContextKeyClient).(string) _ = ctx.Value(constants.ContextKeyClientKey).(string) + if clientID == "" { + return nil, common.NewError("invalid_operation", "Invalid client") + } + + if allocationObj.OwnerID != clientID && allocationObj.RepairerID != clientID { + return nil, common.NewError("invalid_operation", "Operation needs to be performed by the owner or the payer of the allocation") + } + valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), allocationObj.OwnerPublicKey) if !valid || err != nil { return nil, common.NewError("invalid_signature", "Invalid signature") } - if clientID == "" { - return nil, common.NewError("invalid_operation", "Invalid client") - } - connectionID := r.FormValue("connection_id") if connectionID == "" { return nil, common.NewError("invalid_parameters", "Invalid connection id passed")