public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RBAC: Validate plugin app access permission targets the plugin (#59468)

Browse Source 
* RBAC: Validate plugin app access permission targets the plugin

* Fix service test
This commit is contained in:
Gabriel MABILLE
2022-11-30 13:55:07 +01:00
committed by GitHub
parent ddc3706f19
commit 32a498e04f
4 changed files with 32 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/pluginutils/utils.go
+5
View File
@@ -17,6 +17,11 @@ func ValidatePluginPermissions(pluginID string, permissions []ac.Permission) err
return &ac.ErrorActionPrefixMissing{Action: permissions[i].Action,
Prefixes: []string{plugins.ActionAppAccess, pluginID + ":", pluginID + "."}}
}
if strings.HasPrefix(permissions[i].Action, plugins.ActionAppAccess) &&
permissions[i].Scope != plugins.ScopeProvider.GetResourceScope(pluginID) {
return &ac.ErrorScopeTarget{Action: permissions[i].Action, Scope: permissions[i].Scope,
ExpectedScope: plugins.ScopeProvider.GetResourceScope(pluginID)}
}
}
return nil