From 5cb7721ab21cb93637202a3bd4cfc0bdbf900eec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Torkel=20=C3=96degaard?= <torkel.odegaard@gmail.com>
Date: Mon, 27 Apr 2015 15:06:42 +0200
Subject: [PATCH 1/3] Updated config sample.ini with oauth allow_sign_up

---
 conf/defaults.ini | 3 ++-
 conf/sample.ini   | 8 ++++----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/conf/defaults.ini b/conf/defaults.ini
index 6bb3fb80857..e6e82badb24 100644
--- a/conf/defaults.ini
+++ b/conf/defaults.ini
@@ -137,6 +137,7 @@ org_role = Viewer
 #################################### Github Auth ##########################
 [auth.github]
 enabled = false
+allow_sign_up = false
 client_id = some_id
 client_secret = some_secret
 scopes = user:email
@@ -144,11 +145,11 @@ auth_url = https://github.com/login/oauth/authorize
 token_url = https://github.com/login/oauth/access_token
 api_url = https://api.github.com/user
 allowed_domains =
-allow_sign_up = false
 
 #################################### Google Auth ##########################
 [auth.google]
 enabled = false
+allow_sign_up = false
 client_id = some_client_id
 client_secret = some_client_secret
 scopes = https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email
diff --git a/conf/sample.ini b/conf/sample.ini
index 68bd3eb3a1d..c0b427fd1a4 100644
--- a/conf/sample.ini
+++ b/conf/sample.ini
@@ -136,26 +136,26 @@
 #################################### Github Auth ##########################
 [auth.github]
 ;enabled = false
+;allow_sign_up = false
 ;client_id = some_id
 ;client_secret = some_secret
 ;scopes = user:email
 ;auth_url = https://github.com/login/oauth/authorize
 ;token_url = https://github.com/login/oauth/access_token
 ;api_url = https://api.github.com/user
-# Uncomment bellow to only allow specific email domains
-; allowed_domains = mycompany.com othercompany.com
+;allowed_domains =
 
 #################################### Google Auth ##########################
 [auth.google]
 ;enabled = false
+;allow_sign_up = false
 ;client_id = some_client_id
 ;client_secret = some_client_secret
 ;scopes = https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email
 ;auth_url = https://accounts.google.com/o/oauth2/auth
 ;token_url = https://accounts.google.com/o/oauth2/token
 ;api_url = https://www.googleapis.com/oauth2/v1/userinfo
-# Uncomment bellow to only allow specific email domains
-; allowed_domains = mycompany.com othercompany.com
+;allowed_domains =
 
 #################################### Logging ##########################
 [log]

From 5175cf70ef53a551c9b51d1981b8577859eb6289 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Torkel=20=C3=96degaard?= <torkel.odegaard@gmail.com>
Date: Mon, 27 Apr 2015 15:07:13 +0200
Subject: [PATCH 2/3] fixed version in package.json

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 8785632eaee..64e393616f6 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
     "company": "Coding Instinct AB"
   },
   "name": "grafana",
-  "version": "2.1.0-pre1",
+  "version": "2.0.3-pre1",
   "repository": {
     "type": "git",
     "url": "http://github.com/torkelo/grafana.git"

From d10ce90936cc6f4c53e584f97af39c300e7f6066 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Torkel=20=C3=96degaard?= <torkel.odegaard@gmail.com>
Date: Wed, 29 Apr 2015 15:50:47 +0200
Subject: [PATCH 3/3] Fixed XSS issue with file based dashboards, was really
 casued by an issue with alertSrv accepting html in message alerts

---
 public/app/routes/dashLoadControllers.js | 2 +-
 public/app/services/alertSrv.js          | 2 +-
 public/views/index.html                  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/public/app/routes/dashLoadControllers.js b/public/app/routes/dashLoadControllers.js
index b19b0c9664f..570ce2b18c1 100644
--- a/public/app/routes/dashLoadControllers.js
+++ b/public/app/routes/dashLoadControllers.js
@@ -76,7 +76,7 @@ function (angular, _, kbn, moment, $) {
         }
         return result.data;
       },function() {
-        $scope.appEvent('alert-error', ["Dashboard load failed", "Could not load <i>dashboards/"+file+"</i>. Please make sure it exists"]);
+        $scope.appEvent('alert-error', ["Dashboard load failed", "Could not load "+file+". Please make sure it exists"]);
         return false;
       });
     };
diff --git a/public/app/services/alertSrv.js b/public/app/services/alertSrv.js
index d38c1f4aecc..4a8ef273523 100644
--- a/public/app/services/alertSrv.js
+++ b/public/app/services/alertSrv.js
@@ -29,7 +29,7 @@ function (angular, _) {
     this.set = function(title,text,severity,timeout) {
       var newAlert = {
         title: title || '',
-        text: $sce.trustAsHtml(text || ''),
+        text: text || '',
         severity: severity || 'info',
       };
 
diff --git a/public/views/index.html b/public/views/index.html
index d5dfab06a64..8fb4a93bba6 100644
--- a/public/views/index.html
+++ b/public/views/index.html
@@ -35,7 +35,7 @@
 						<i class="fa fa-times-circle"></i>
 					</button>
 					<div class="alert-title">{{alert.title}}</div>
-					<div ng-bind-html='alert.text'></div>
+					<div ng-bind='alert.text'></div>
 				</div>
 			</div>