From 1d83694679cf748e8beab98c02cd6a2fd340a436 Mon Sep 17 00:00:00 2001 From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com> Date: Tue, 31 May 2022 06:58:06 -0400 Subject: [PATCH] RBAC: drop permissions with folder:create action added by migration (#49878) (#49891) (cherry picked from commit f4f25d911b77f98ed3748365b807360d3d219926) Co-authored-by: Karl Persson --- .../accesscontrol/dashboard_permissions.go | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/pkg/services/sqlstore/migrations/accesscontrol/dashboard_permissions.go b/pkg/services/sqlstore/migrations/accesscontrol/dashboard_permissions.go index 409af398583..7ba629bfd80 100644 --- a/pkg/services/sqlstore/migrations/accesscontrol/dashboard_permissions.go +++ b/pkg/services/sqlstore/migrations/accesscontrol/dashboard_permissions.go @@ -41,13 +41,11 @@ var folderPermissionTranslation = map[models.PermissionType][]string{ dashboards.ActionDashboardsCreate, dashboards.ActionFoldersRead, dashboards.ActionFoldersWrite, - dashboards.ActionFoldersCreate, dashboards.ActionFoldersDelete, }...), models.PERMISSION_ADMIN: append(dashboardPermissionTranslation[models.PERMISSION_ADMIN], []string{ dashboards.ActionFoldersRead, dashboards.ActionFoldersWrite, - dashboards.ActionFoldersCreate, dashboards.ActionFoldersDelete, dashboards.ActionFoldersPermissionsRead, dashboards.ActionFoldersPermissionsWrite, @@ -57,6 +55,7 @@ var folderPermissionTranslation = map[models.PermissionType][]string{ func AddDashboardPermissionsMigrator(mg *migrator.Migrator) { mg.AddMigration("dashboard permissions", &dashboardPermissionsMigrator{}) mg.AddMigration("dashboard permissions uid scopes", &dashboardUidPermissionMigrator{}) + mg.AddMigration("drop managed folder create actions", &managedFolderCreateAction{}) } var _ migrator.CodeMigration = new(dashboardPermissionsMigrator) @@ -280,3 +279,18 @@ func (d *dashboardUidPermissionMigrator) migrateIdScopes(sess *xorm.Session) err } return nil } + +type managedFolderCreateAction struct { + migrator.MigrationBase +} + +func (m *managedFolderCreateAction) SQL(dialect migrator.Dialect) string { + return CodeMigrationSQL +} + +func (m *managedFolderCreateAction) Exec(sess *xorm.Session, migrator *migrator.Migrator) error { + if _, err := sess.Exec("DELETE FROM permission WHERE action = 'folders:create' AND scope LIKE 'folders:uid:%'"); err != nil { + return err + } + return nil +}