From 10f55f55117fc8c39270ecd2642b7472121c90fd Mon Sep 17 00:00:00 2001 From: Marcus Efraimsson Date: Wed, 29 Aug 2018 12:34:27 +0200 Subject: [PATCH 1/7] changelog: add notes about 4.6.4 and 5.2.3 releases --- CHANGELOG.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5137e716b49..aed25afb02e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -73,6 +73,12 @@ These are new features that's still being worked on and are in an experimental p * **Frontend**: Convert all Frontend Karma tests to Jest tests [#12224](https://github.com/grafana/grafana/issues/12224) +# 5.2.3 (2018-08-29) + +### Important fix for LDAP & OAuth login vulnerability + +See [security announcement](https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050) for details. + # 5.2.2 (2018-07-25) ### Minor @@ -441,6 +447,12 @@ The following properties have been deprecated and will be removed in a future re - `uri` property in `GET /api/search` -> Use new `url` or `uid` property instead - `meta.slug` property in `GET /api/dashboards/uid/:uid` and `GET /api/dashboards/db/:slug` -> Use new `meta.url` or `dashboard.uid` property instead +# 4.6.4 (2018-08-29) + +### Important fix for LDAP & OAuth login vulnerability + +See [security announcement](https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050) for details. + # 4.6.3 (2017-12-14) ## Fixes From 1e2fde238c0e86bcc2cbb8041a20f01b5736d780 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Torkel=20=C3=96degaard?= Date: Wed, 29 Aug 2018 13:26:23 +0200 Subject: [PATCH 2/7] docs: corrected docs description for setting --- docs/sources/installation/configuration.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/sources/installation/configuration.md b/docs/sources/installation/configuration.md index 4b14829b689..3394dfe16bc 100644 --- a/docs/sources/installation/configuration.md +++ b/docs/sources/installation/configuration.md @@ -266,7 +266,8 @@ The number of days the keep me logged in / remember me cookie lasts. ### secret_key -Used for signing keep me logged in / remember me cookies. +Used for signing some datasource settings like secrets and passwords. Cannot be changed without requiring an update +to datasource settings to re-encode them. ### disable_gravatar From 800ba84f671d0ef646a4bb1d2c2715da243db543 Mon Sep 17 00:00:00 2001 From: Marcus Efraimsson Date: Wed, 29 Aug 2018 13:29:29 +0200 Subject: [PATCH 3/7] update latest.json to latest stable version --- latest.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/latest.json b/latest.json index 8e26289c856..7b36131fea2 100644 --- a/latest.json +++ b/latest.json @@ -1,4 +1,4 @@ { - "stable": "5.2.0", - "testing": "5.2.0" + "stable": "5.2.3", + "testing": "5.2.3" } From 5e0d0c5816677a99f5408722ce46b83ca1f219e6 Mon Sep 17 00:00:00 2001 From: Patrick O'Carroll Date: Wed, 29 Aug 2018 14:26:50 +0200 Subject: [PATCH 4/7] changed var to const (#13061) --- public/app/core/app_events.ts | 2 +- .../components/code_editor/code_editor.ts | 4 +- .../app/core/components/dashboard_selector.ts | 2 +- .../core/components/json_explorer/helpers.ts | 4 +- .../components/json_explorer/json_explorer.ts | 2 +- .../app/core/components/jsontree/jsontree.ts | 2 +- .../layout_selector/layout_selector.ts | 4 +- .../core/components/query_part/query_part.ts | 6 +-- .../query_part/query_part_editor.ts | 38 +++++++------- public/app/core/components/search/search.ts | 4 +- .../app/core/components/sidemenu/sidemenu.ts | 4 +- public/app/core/components/switch.ts | 2 +- public/app/core/directives/give_focus.ts | 4 +- public/app/core/directives/misc.ts | 28 +++++------ .../app/core/directives/ng_model_on_blur.ts | 2 +- .../app/core/directives/rebuild_on_change.ts | 2 +- public/app/core/directives/tags.ts | 6 +-- public/app/core/jquery_extended.ts | 11 ++-- public/app/core/live/live_srv.ts | 6 +-- public/app/core/nav_model_srv.ts | 4 +- public/app/core/profiler.ts | 10 ++-- public/app/core/services/context_srv.ts | 2 +- public/app/core/services/impression_srv.ts | 2 +- public/app/core/services/ng_react.ts | 50 +++++++++---------- public/app/core/services/search_srv.ts | 2 +- public/app/core/utils/datemath.ts | 12 ++--- public/app/core/utils/emitter.ts | 2 +- public/app/core/utils/model_utils.ts | 2 +- public/app/core/utils/outline.ts | 8 +-- public/app/core/utils/sort_by_keys.ts | 2 +- public/app/core/utils/ticks.ts | 24 ++++----- public/app/features/alerting/alert_def.ts | 18 +++---- .../app/features/alerting/alert_tab_ctrl.ts | 30 +++++------ .../app/features/alerting/threshold_mapper.ts | 8 +-- .../features/dashboard/dashboard_migration.ts | 16 +++--- .../app/features/dashboard/dashboard_model.ts | 14 +++--- public/app/features/dashboard/panel_model.ts | 4 +- .../app/features/panel/metrics_panel_ctrl.ts | 22 ++++---- public/app/features/panel/metrics_tab.ts | 2 +- public/app/features/panel/panel_ctrl.ts | 28 +++++------ public/app/features/templating/variable.ts | 4 +- .../cloudwatch/query_parameter_ctrl.ts | 20 ++++---- .../datasource/graphite/add_graphite_func.ts | 14 +++--- .../datasource/graphite/func_editor.ts | 44 ++++++++-------- .../app/plugins/datasource/graphite/gfunc.ts | 16 +++--- .../datasource/graphite/graphite_query.ts | 20 ++++---- .../app/plugins/datasource/graphite/lexer.ts | 40 +++++++-------- .../app/plugins/datasource/graphite/parser.ts | 26 +++++----- .../plugins/datasource/graphite/query_ctrl.ts | 10 ++-- .../plugins/datasource/mixed/datasource.ts | 8 +-- 50 files changed, 298 insertions(+), 299 deletions(-) diff --git a/public/app/core/app_events.ts b/public/app/core/app_events.ts index 26dd74bcb00..6af7913167b 100644 --- a/public/app/core/app_events.ts +++ b/public/app/core/app_events.ts @@ -1,4 +1,4 @@ import { Emitter } from './utils/emitter'; -var appEvents = new Emitter(); +const appEvents = new Emitter(); export default appEvents; diff --git a/public/app/core/components/code_editor/code_editor.ts b/public/app/core/components/code_editor/code_editor.ts index 66aec778d73..6ae1a99f245 100644 --- a/public/app/core/components/code_editor/code_editor.ts +++ b/public/app/core/components/code_editor/code_editor.ts @@ -99,9 +99,9 @@ function link(scope, elem, attrs) { if (scope.codeEditorFocus) { setTimeout(function() { textarea.focus(); - var domEl = textarea[0]; + const domEl = textarea[0]; if (domEl.setSelectionRange) { - var pos = textarea.val().length * 2; + const pos = textarea.val().length * 2; domEl.setSelectionRange(pos, pos); } }, 100); diff --git a/public/app/core/components/dashboard_selector.ts b/public/app/core/components/dashboard_selector.ts index 379fd441a19..e1809f3d42c 100644 --- a/public/app/core/components/dashboard_selector.ts +++ b/public/app/core/components/dashboard_selector.ts @@ -1,6 +1,6 @@ import coreModule from 'app/core/core_module'; -var template = ` +const template = ` `; diff --git a/public/app/core/components/json_explorer/helpers.ts b/public/app/core/components/json_explorer/helpers.ts index c445e1b0667..bc7468b3b21 100644 --- a/public/app/core/components/json_explorer/helpers.ts +++ b/public/app/core/components/json_explorer/helpers.ts @@ -12,7 +12,7 @@ function escapeString(str: string): string { * Determines if a value is an object */ export function isObject(value: any): boolean { - var type = typeof value; + const type = typeof value; return !!value && type === 'object'; } @@ -55,7 +55,7 @@ export function getType(object: Object): string { * Generates inline preview for a JavaScript object based on a value */ export function getValuePreview(object: Object, value: string): string { - var type = getType(object); + const type = getType(object); if (type === 'null' || type === 'undefined') { return type; diff --git a/public/app/core/components/json_explorer/json_explorer.ts b/public/app/core/components/json_explorer/json_explorer.ts index 790ed442d5c..779e5a93cba 100644 --- a/public/app/core/components/json_explorer/json_explorer.ts +++ b/public/app/core/components/json_explorer/json_explorer.ts @@ -279,7 +279,7 @@ export class JsonExplorer { const objectWrapperSpan = createElement('span'); // get constructor name and append it to wrapper span - var constructorName = createElement('span', 'constructor-name', this.constructorName); + const constructorName = createElement('span', 'constructor-name', this.constructorName); objectWrapperSpan.appendChild(constructorName); // if it's an array append the array specific elements like brackets and length diff --git a/public/app/core/components/jsontree/jsontree.ts b/public/app/core/components/jsontree/jsontree.ts index e127d7b14a9..5fbda5560b3 100644 --- a/public/app/core/components/jsontree/jsontree.ts +++ b/public/app/core/components/jsontree/jsontree.ts @@ -11,7 +11,7 @@ coreModule.directive('jsonTree', [ rootName: '@', }, link: function(scope, elem) { - var jsonExp = new JsonExplorer(scope.object, 3, { + const jsonExp = new JsonExplorer(scope.object, 3, { animateOpen: true, }); diff --git a/public/app/core/components/layout_selector/layout_selector.ts b/public/app/core/components/layout_selector/layout_selector.ts index 91a3afea250..a28abe19251 100644 --- a/public/app/core/components/layout_selector/layout_selector.ts +++ b/public/app/core/components/layout_selector/layout_selector.ts @@ -1,7 +1,7 @@ import store from 'app/core/store'; import coreModule from 'app/core/core_module'; -var template = ` +const template = `