Alerting: update authorization logic to use proper legacy roles when fine-grained access is disabled (#46931)
* require legacy Editor for post, put, delete endpoints * require user to be signed in on group level because handler that checks that user has role Editor does not check it is signed in
This commit is contained in:
@@ -12,6 +12,7 @@ import (
|
||||
|
||||
"github.com/grafana/grafana/pkg/api/response"
|
||||
"github.com/grafana/grafana/pkg/api/routing"
|
||||
"github.com/grafana/grafana/pkg/middleware"
|
||||
"github.com/grafana/grafana/pkg/models"
|
||||
"github.com/grafana/grafana/pkg/services/ngalert/metrics"
|
||||
)
|
||||
@@ -81,5 +82,5 @@ func (api *API) RegisterPrometheusApiEndpoints(srv PrometheusApiForkingService,
|
||||
m,
|
||||
),
|
||||
)
|
||||
})
|
||||
}, middleware.ReqSignedIn)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user