From c6ea9717f97dcd77a7f60edc1d3e682c47acfc30 Mon Sep 17 00:00:00 2001
From: anjali-rayy <rayanjali2802@gmail.com>
Date: Mon, 18 May 2026 12:55:58 +0530
Subject: [PATCH] fix: use filename hashing for disable/enable, skip ACL when
 bucketObjectsACL is false

---
 packages/uploadfs/lib/storage/s3.js | 35 +++++++++++++++++++++++++----
 1 file changed, 31 insertions(+), 4 deletions(-)

diff --git a/packages/uploadfs/lib/storage/s3.js b/packages/uploadfs/lib/storage/s3.js
index 4831c2ab11..4a7fc8567c 100644
--- a/packages/uploadfs/lib/storage/s3.js
+++ b/packages/uploadfs/lib/storage/s3.js
@@ -8,6 +8,7 @@ const {
   S3Client,
   GetObjectCommand,
   DeleteObjectCommand,
+  CopyObjectCommand,
   PutObjectAclCommand
 } = require('@aws-sdk/client-s3');
 const { Upload } = require('@aws-sdk/lib-storage');
@@ -48,7 +49,7 @@ module.exports = function() {
       }
 
       bucket = options.bucket;
-      bucketObjectsACL = options.bucketObjectsACL || 'public-read';
+      bucketObjectsACL = (options.bucketObjectsACL === false) ? false : (options.bucketObjectsACL || 'public-read');
       disabledBucketObjectsACL = options.disabledBucketObjectsACL || 'private';
       noGzipContentTypes = options.noGzipContentTypes || require('./noGzipContentTypes');
       addNoGzipContentTypes = options.addNoGzipContentTypes || [];
@@ -116,12 +117,15 @@ module.exports = function() {
 
       const params = {
         Bucket: bucket,
-        ACL: bucketObjectsACL,
         Key: utils.removeLeadingSlash(self.options, path),
         Body: inputStream,
         ContentType: contentType
       };
 
+      if (bucketObjectsACL !== false) {
+        params.ACL = bucketObjectsACL;
+      }
+
       if (gzipAppropriate(contentType)) {
         params.ContentEncoding = 'gzip';
         const gzip = require('zlib').createGzip();
@@ -230,24 +234,36 @@ module.exports = function() {
     },
 
     enable: function(path, callback) {
+      if (self.options.disabledFileKey) {
+        const dPath = utils.getDisabledPath(path, self.options.disabledFileKey);
+        return self._copyObject(dPath, path, function(err) {
+          if (err) return callback(err);
+          return self.remove(dPath, callback);
+        });
+      }
       const command = new PutObjectAclCommand({
         Bucket: bucket,
         ACL: bucketObjectsACL,
         Key: utils.removeLeadingSlash(self.options, path)
       });
-
       client.send(command)
         .then(result => callback(null, result))
         .catch(err => callback(err));
     },
 
     disable: function(path, callback) {
+      if (self.options.disabledFileKey) {
+        const dPath = utils.getDisabledPath(path, self.options.disabledFileKey);
+        return self._copyObject(path, dPath, function(err) {
+          if (err) return callback(err);
+          return self.remove(path, callback);
+        });
+      }
       const command = new PutObjectAclCommand({
         Bucket: bucket,
         ACL: disabledBucketObjectsACL,
         Key: utils.removeLeadingSlash(self.options, path)
       });
-
       client.send(command)
         .then(result => callback(null, result))
         .catch(err => callback(err));
@@ -264,6 +280,17 @@ module.exports = function() {
       return utils.addPathToUrl(self.options, url, path);
     },
 
+    _copyObject: function(srcPath, destPath, callback) {
+      const command = new CopyObjectCommand({
+        Bucket: bucket,
+        CopySource: bucket + '/' + utils.removeLeadingSlash(self.options, srcPath),
+        Key: utils.removeLeadingSlash(self.options, destPath)
+      });
+      client.send(command)
+        .then(result => callback(null, result))
+        .catch(err => callback(err));
+    },
+
     destroy: function(callback) {
       // No file descriptors or timeouts held
       return callback(null);