diff --git a/CHANGELOG.md b/CHANGELOG.md index 5137e716b49..aed25afb02e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -73,6 +73,12 @@ These are new features that's still being worked on and are in an experimental p * **Frontend**: Convert all Frontend Karma tests to Jest tests [#12224](https://github.com/grafana/grafana/issues/12224) +# 5.2.3 (2018-08-29) + +### Important fix for LDAP & OAuth login vulnerability + +See [security announcement](https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050) for details. + # 5.2.2 (2018-07-25) ### Minor @@ -441,6 +447,12 @@ The following properties have been deprecated and will be removed in a future re - `uri` property in `GET /api/search` -> Use new `url` or `uid` property instead - `meta.slug` property in `GET /api/dashboards/uid/:uid` and `GET /api/dashboards/db/:slug` -> Use new `meta.url` or `dashboard.uid` property instead +# 4.6.4 (2018-08-29) + +### Important fix for LDAP & OAuth login vulnerability + +See [security announcement](https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050) for details. + # 4.6.3 (2017-12-14) ## Fixes diff --git a/Gopkg.lock b/Gopkg.lock index 6f08e208ecd..bd247d691dd 100644 --- a/Gopkg.lock +++ b/Gopkg.lock @@ -427,12 +427,6 @@ revision = "1744e2970ca51c86172c8190fadad617561ed6e7" version = "v1.0.0" -[[projects]] - branch = "master" - name = "github.com/shurcooL/sanitized_anchor_name" - packages = ["."] - revision = "86672fcb3f950f35f2e675df2240550f2a50762f" - [[projects]] name = "github.com/smartystreets/assertions" packages = [ @@ -679,6 +673,6 @@ [solve-meta] analyzer-name = "dep" analyzer-version = 1 - inputs-digest = "cb8e7fd81f23ec987fc4d5dd9d31ae0f1164bc2f30cbea2fe86e0d97dd945beb" + inputs-digest = "81a37e747b875cf870c1b9486fa3147e704dea7db8ba86f7cb942d3ddc01d3e3" solver-name = "gps-cdcl" solver-version = 1 diff --git a/docs/sources/installation/configuration.md b/docs/sources/installation/configuration.md index 4b14829b689..3394dfe16bc 100644 --- a/docs/sources/installation/configuration.md +++ b/docs/sources/installation/configuration.md @@ -266,7 +266,8 @@ The number of days the keep me logged in / remember me cookie lasts. ### secret_key -Used for signing keep me logged in / remember me cookies. +Used for signing some datasource settings like secrets and passwords. Cannot be changed without requiring an update +to datasource settings to re-encode them. ### disable_gravatar diff --git a/latest.json b/latest.json index 8e26289c856..7b36131fea2 100644 --- a/latest.json +++ b/latest.json @@ -1,4 +1,4 @@ { - "stable": "5.2.0", - "testing": "5.2.0" + "stable": "5.2.3", + "testing": "5.2.3" } diff --git a/public/app/core/app_events.ts b/public/app/core/app_events.ts index 26dd74bcb00..6af7913167b 100644 --- a/public/app/core/app_events.ts +++ b/public/app/core/app_events.ts @@ -1,4 +1,4 @@ import { Emitter } from './utils/emitter'; -var appEvents = new Emitter(); +const appEvents = new Emitter(); export default appEvents; diff --git a/public/app/core/components/code_editor/code_editor.ts b/public/app/core/components/code_editor/code_editor.ts index 66aec778d73..6ae1a99f245 100644 --- a/public/app/core/components/code_editor/code_editor.ts +++ b/public/app/core/components/code_editor/code_editor.ts @@ -99,9 +99,9 @@ function link(scope, elem, attrs) { if (scope.codeEditorFocus) { setTimeout(function() { textarea.focus(); - var domEl = textarea[0]; + const domEl = textarea[0]; if (domEl.setSelectionRange) { - var pos = textarea.val().length * 2; + const pos = textarea.val().length * 2; domEl.setSelectionRange(pos, pos); } }, 100); diff --git a/public/app/core/components/dashboard_selector.ts b/public/app/core/components/dashboard_selector.ts index 379fd441a19..e1809f3d42c 100644 --- a/public/app/core/components/dashboard_selector.ts +++ b/public/app/core/components/dashboard_selector.ts @@ -1,6 +1,6 @@ import coreModule from 'app/core/core_module'; -var template = ` +const template = ` `; diff --git a/public/app/core/components/grafana_app.ts b/public/app/core/components/grafana_app.ts index 1f55bc332ac..b715a20e28f 100644 --- a/public/app/core/components/grafana_app.ts +++ b/public/app/core/components/grafana_app.ts @@ -49,7 +49,7 @@ export class GrafanaCtrl { }; $rootScope.onAppEvent = function(name, callback, localScope) { - var unbind = $rootScope.$on(name, callback); + const unbind = $rootScope.$on(name, callback); var callerScope = this; if (callerScope.$id === 1 && !localScope) { console.log('warning rootScope onAppEvent called without localscope'); @@ -76,7 +76,7 @@ export function grafanaAppDirective(playlistSrv, contextSrv, $timeout, $rootScop controller: GrafanaCtrl, link: (scope, elem) => { var sidemenuOpen; - var body = $('body'); + const body = $('body'); // see https://github.com/zenorocha/clipboard.js/issues/155 $.fn.modal.Constructor.prototype.enforceFocus = function() {}; @@ -153,7 +153,7 @@ export function grafanaAppDirective(playlistSrv, contextSrv, $timeout, $rootScop // handle in active view state class var lastActivity = new Date().getTime(); var activeUser = true; - var inActiveTimeLimit = 60 * 1000; + const inActiveTimeLimit = 60 * 1000; var sidemenuHidden = false; function checkForInActiveUser() { @@ -215,16 +215,16 @@ export function grafanaAppDirective(playlistSrv, contextSrv, $timeout, $rootScop // handle document clicks that should hide things body.click(function(evt) { - var target = $(evt.target); + const target = $(evt.target); if (target.parents().length === 0) { return; } // for stuff that animates, slides out etc, clicking it needs to // hide it right away - var clickAutoHide = target.closest('[data-click-hide]'); + const clickAutoHide = target.closest('[data-click-hide]'); if (clickAutoHide.length) { - var clickAutoHideParent = clickAutoHide.parent(); + const clickAutoHideParent = clickAutoHide.parent(); clickAutoHide.detach(); setTimeout(function() { clickAutoHideParent.append(clickAutoHide); @@ -245,7 +245,7 @@ export function grafanaAppDirective(playlistSrv, contextSrv, $timeout, $rootScop } // hide popovers - var popover = elem.find('.popover'); + const popover = elem.find('.popover'); if (popover.length > 0 && target.parents('.graph-legend').length === 0) { popover.hide(); } diff --git a/public/app/core/components/json_explorer/helpers.ts b/public/app/core/components/json_explorer/helpers.ts index c445e1b0667..bc7468b3b21 100644 --- a/public/app/core/components/json_explorer/helpers.ts +++ b/public/app/core/components/json_explorer/helpers.ts @@ -12,7 +12,7 @@ function escapeString(str: string): string { * Determines if a value is an object */ export function isObject(value: any): boolean { - var type = typeof value; + const type = typeof value; return !!value && type === 'object'; } @@ -55,7 +55,7 @@ export function getType(object: Object): string { * Generates inline preview for a JavaScript object based on a value */ export function getValuePreview(object: Object, value: string): string { - var type = getType(object); + const type = getType(object); if (type === 'null' || type === 'undefined') { return type; diff --git a/public/app/core/components/json_explorer/json_explorer.ts b/public/app/core/components/json_explorer/json_explorer.ts index 790ed442d5c..779e5a93cba 100644 --- a/public/app/core/components/json_explorer/json_explorer.ts +++ b/public/app/core/components/json_explorer/json_explorer.ts @@ -279,7 +279,7 @@ export class JsonExplorer { const objectWrapperSpan = createElement('span'); // get constructor name and append it to wrapper span - var constructorName = createElement('span', 'constructor-name', this.constructorName); + const constructorName = createElement('span', 'constructor-name', this.constructorName); objectWrapperSpan.appendChild(constructorName); // if it's an array append the array specific elements like brackets and length diff --git a/public/app/core/components/jsontree/jsontree.ts b/public/app/core/components/jsontree/jsontree.ts index e127d7b14a9..5fbda5560b3 100644 --- a/public/app/core/components/jsontree/jsontree.ts +++ b/public/app/core/components/jsontree/jsontree.ts @@ -11,7 +11,7 @@ coreModule.directive('jsonTree', [ rootName: '@', }, link: function(scope, elem) { - var jsonExp = new JsonExplorer(scope.object, 3, { + const jsonExp = new JsonExplorer(scope.object, 3, { animateOpen: true, }); diff --git a/public/app/core/components/layout_selector/layout_selector.ts b/public/app/core/components/layout_selector/layout_selector.ts index 91a3afea250..a28abe19251 100644 --- a/public/app/core/components/layout_selector/layout_selector.ts +++ b/public/app/core/components/layout_selector/layout_selector.ts @@ -1,7 +1,7 @@ import store from 'app/core/store'; import coreModule from 'app/core/core_module'; -var template = ` +const template = `