From 2617a25fb5c2bf5d4ad66017a82973ba99d3776d Mon Sep 17 00:00:00 2001 From: Gabriel MABILLE Date: Tue, 19 Jul 2022 09:30:54 +0200 Subject: [PATCH] Fix: Use ac.parameter for the scope protecting plugins routes (#52389) * Fix: Use parameter for the scope protecting /a routes * Fix: Use parameter for the scope protecting /plugins/resources routes --- pkg/api/api.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/api/api.go b/pkg/api/api.go index 9ab32650ac4..8eac11dac35 100644 --- a/pkg/api/api.go +++ b/pkg/api/api.go @@ -91,7 +91,7 @@ func (hs *HTTPServer) registerRoutes() { r.Get("/plugins/:id/edit", reqSignedIn, hs.Index) // deprecated r.Get("/plugins/:id/page/:page", reqSignedIn, hs.Index) // App Root Page - appPluginIDScope := plugins.ScopeProvider.GetResourceScope(":id") + appPluginIDScope := plugins.ScopeProvider.GetResourceScope(ac.Parameter(":id")) r.Get("/a/:id/*", authorize(reqSignedIn, ac.EvalPermission(plugins.ActionAppAccess, appPluginIDScope)), hs.Index) r.Get("/a/:id", authorize(reqSignedIn, ac.EvalPermission(plugins.ActionAppAccess, appPluginIDScope)), hs.Index) @@ -334,7 +334,7 @@ func (hs *HTTPServer) registerRoutes() { datasourceRoute.Get("/id/:name", authorize(reqSignedIn, ac.EvalPermission(datasources.ActionIDRead, nameScope)), routing.Wrap(hs.GetDataSourceIdByName)) }) - pluginIDScope := plugins.ScopeProvider.GetResourceScope(":pluginId") + pluginIDScope := plugins.ScopeProvider.GetResourceScope(ac.Parameter(":pluginId")) apiRoute.Get("/plugins", routing.Wrap(hs.GetPluginList)) apiRoute.Get("/plugins/:pluginId/settings", routing.Wrap(hs.GetPluginSettingByID)) // RBAC check performed in handler for App Plugins apiRoute.Get("/plugins/:pluginId/markdown/:name", routing.Wrap(hs.GetPluginMarkdown))