From 279333860f0c9fa37486ec0f660ca48f7488d6d6 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 27 Sep 2024 09:42:47 +0000 Subject: [PATCH] apply security patch: v11.2.x/0001-Alerting-Fix-permission-on-external-rule-write-endpo.patch commit a2c5ee91899ce8934453e5f8b933a9ad4fa8f7f1 Author: Alex Weaver Date: Thu Aug 22 11:52:43 2024 -0500 Alerting: Fix permission on external rule write endpoint --- pkg/services/ngalert/api/authorization.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/services/ngalert/api/authorization.go b/pkg/services/ngalert/api/authorization.go index dd03da7ca4c..2b3a0a45b4e 100644 --- a/pkg/services/ngalert/api/authorization.go +++ b/pkg/services/ngalert/api/authorization.go @@ -112,7 +112,7 @@ func (api *API) authorize(method, path string) web.Handler { case http.MethodGet + "/api/ruler/{DatasourceUID}/api/v1/rules": eval = ac.EvalPermission(ac.ActionAlertingRuleExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID"))) case http.MethodPost + "/api/ruler/{DatasourceUID}/api/v1/rules/{Namespace}": - eval = ac.EvalPermission(ac.ActionAlertingInstancesExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID"))) + eval = ac.EvalPermission(ac.ActionAlertingRuleExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID"))) // Lotex Prometheus-compatible Paths case http.MethodGet + "/api/prometheus/{DatasourceUID}/api/v1/rules":