Another HTTP API fix

pkg/services/sqlstore/dashboard.go

@@ -23,21 +23,17 @@ func SaveDashboard(cmd *m.SaveDashboardCommand) error {
 		dash := cmd.GetDashboardModel()
 
 		// try get existing dashboard
-		existing := m.Dashboard{Slug: dash.Slug, OrgId: dash.OrgId}
-		hasExisting, err := sess.Get(&existing)
-		if err != nil {
-			return err
-		}
+		var existing, sameTitle m.Dashboard
 
-		if hasExisting {
-			// another dashboard with same name
-			if dash.Id != existing.Id {
-				if cmd.Overwrite {
-					dash.Id = existing.Id
-				} else {
-					return m.ErrDashboardWithSameNameExists
-				}
+		if dash.Id > 0 {
+			dashWithIdExists, err := sess.Where("id=? AND org_id=?", dash.Id, dash.OrgId).Get(&existing)
+			if err != nil {
+				return err
 			}
+			if !dashWithIdExists {
+				return m.ErrDashboardNotFound
+			}
+
 			// check for is someone else has written in between
 			if dash.Version != existing.Version {
 				if cmd.Overwrite {
@@ -48,6 +44,22 @@ func SaveDashboard(cmd *m.SaveDashboardCommand) error {
 			}
 		}
 
+		sameTitleExists, err := sess.Where("org_id=? AND slug=?", dash.OrgId, dash.Slug).Get(&sameTitle)
+		if err != nil {
+			return err
+		}
+
+		if sameTitleExists {
+			// another dashboard with same name
+			if dash.Id != sameTitle.Id {
+				if cmd.Overwrite {
+					dash.Id = sameTitle.Id
+				} else {
+					return m.ErrDashboardWithSameNameExists
+				}
+			}
+		}
+
 		affectedRows := int64(0)
 
 		if dash.Id == 0 {

pkg/services/sqlstore/dashboard_test.go

@@ -66,6 +66,24 @@ func TestDashboardDataAccess(t *testing.T) {
 				So(err, ShouldNotBeNil)
 			})
 
+			Convey("Should not be able to overwrite dashboard in another org", func() {
+				query := m.GetDashboardQuery{Slug: "test-dash-23", OrgId: 1}
+				GetDashboard(&query)
+
+				cmd := m.SaveDashboardCommand{
+					OrgId:     2,
+					Overwrite: true,
+					Dashboard: map[string]interface{}{
+						"id":    float64(query.Result.Id),
+						"title": "Expect error",
+						"tags":  []interface{}{},
+					},
+				}
+
+				err := SaveDashboard(&cmd)
+				So(err, ShouldNotBeNil)
+			})
+
 			Convey("Should be able to search for dashboard", func() {
 				query := m.SearchDashboardsQuery{
 					Title: "test",