From 242f4e04c0b8987b8f857ba29b1747016400513d Mon Sep 17 00:00:00 2001 From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com> Date: Fri, 12 May 2023 13:44:45 +0100 Subject: [PATCH] [v10.0.x] Require alert.notifications:write permissions to test receivers and templates (#866) Require alert.notifications:write permissions to test receivers and templates (#865) (cherry picked from commit 3c21ab70075256d4ba8e4fbfdcb15f5a394161fa) Co-authored-by: George Robinson --- pkg/services/ngalert/api/authorization.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/services/ngalert/api/authorization.go b/pkg/services/ngalert/api/authorization.go index 865cc96a418..3f76163a547 100644 --- a/pkg/services/ngalert/api/authorization.go +++ b/pkg/services/ngalert/api/authorization.go @@ -172,10 +172,10 @@ func (api *API) authorize(method, path string) web.Handler { eval = ac.EvalPermission(ac.ActionAlertingNotificationsRead) case http.MethodPost + "/api/alertmanager/grafana/config/api/v1/receivers/test": fallback = middleware.ReqEditorRole - eval = ac.EvalPermission(ac.ActionAlertingNotificationsRead) + eval = ac.EvalPermission(ac.ActionAlertingNotificationsWrite) case http.MethodPost + "/api/alertmanager/grafana/config/api/v1/templates/test": - fallback = middleware.ReqSignedIn - eval = ac.EvalPermission(ac.ActionAlertingNotificationsRead) + fallback = middleware.ReqEditorRole + eval = ac.EvalPermission(ac.ActionAlertingNotificationsWrite) // External Alertmanager Paths case http.MethodDelete + "/api/alertmanager/{DatasourceUID}/config/api/v1/alerts":