From 28dd1ddd8eb1b6d22b0a42dcc23c67985557c440 Mon Sep 17 00:00:00 2001 From: Ieva Date: Thu, 2 May 2024 11:18:29 +0100 Subject: [PATCH] RBAC: Do not set permissions on data sources with wildcard UID in OSS (#87220) do not set permissions on DS with wildcard UID --- .../accesscontrol/ossaccesscontrol/permissions_services.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/services/accesscontrol/ossaccesscontrol/permissions_services.go b/pkg/services/accesscontrol/ossaccesscontrol/permissions_services.go index 5101c049f36..d9ff3e522b5 100644 --- a/pkg/services/accesscontrol/ossaccesscontrol/permissions_services.go +++ b/pkg/services/accesscontrol/ossaccesscontrol/permissions_services.go @@ -322,8 +322,8 @@ func (e DatasourcePermissionsService) SetBuiltInRolePermission(ctx context.Conte func (e DatasourcePermissionsService) SetPermissions(ctx context.Context, orgID int64, resourceID string, commands ...accesscontrol.SetResourcePermissionCommand) ([]accesscontrol.ResourcePermission, error) { var dbCommands []resourcepermissions.SetResourcePermissionsCommand for _, cmd := range commands { - // Only set query permissions for built-in roles - if cmd.Permission != "Query" || cmd.BuiltinRole == "" { + // Only set query permissions for built-in roles; do not set permissions for data sources with * as UID, as this would grant wildcard permissions + if cmd.Permission != "Query" || cmd.BuiltinRole == "" || resourceID == "*" { continue } actions := DatasourceQueryActions