From 2fbc070fd10db827d520b37b21090bb0e37d7860 Mon Sep 17 00:00:00 2001 From: "grafana-delivery-bot[bot]" <132647405+grafana-delivery-bot[bot]@users.noreply.github.com> Date: Wed, 21 Feb 2024 15:20:17 +0200 Subject: [PATCH] [v10.4.x] Snapshots: delete from same org (#83170) Snapshots: delete from same org (#83111) delete in org (cherry picked from commit 809c1eaddb7f66260c799b402486a19748c65108) Co-authored-by: Ryan McKinley --- pkg/api/dashboard_snapshot.go | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/pkg/api/dashboard_snapshot.go b/pkg/api/dashboard_snapshot.go index b217d854a5f..f5fc19de817 100644 --- a/pkg/api/dashboard_snapshot.go +++ b/pkg/api/dashboard_snapshot.go @@ -192,10 +192,9 @@ func (hs *HTTPServer) DeleteDashboardSnapshot(c *contextmodel.ReqContext) respon return response.Error(http.StatusNotFound, "Failed to get dashboard snapshot", nil) } - // TODO: enforce org ID same - // if queryResult.OrgID != c.OrgID { - // return response.Error(http.StatusUnauthorized, "OrgID mismatch", nil) - // } + if queryResult.OrgID != c.OrgID { + return response.Error(http.StatusUnauthorized, "OrgID mismatch", nil) + } if queryResult.External { err := dashboardsnapshots.DeleteExternalDashboardSnapshot(queryResult.ExternalDeleteURL)