diff --git a/pkg/services/sqlstore/dashboard.go b/pkg/services/sqlstore/dashboard.go index f4be6d55edf..d34a6fcdd51 100644 --- a/pkg/services/sqlstore/dashboard.go +++ b/pkg/services/sqlstore/dashboard.go @@ -23,21 +23,17 @@ func SaveDashboard(cmd *m.SaveDashboardCommand) error { dash := cmd.GetDashboardModel() // try get existing dashboard - existing := m.Dashboard{Slug: dash.Slug, OrgId: dash.OrgId} - hasExisting, err := sess.Get(&existing) - if err != nil { - return err - } + var existing, sameTitle m.Dashboard - if hasExisting { - // another dashboard with same name - if dash.Id != existing.Id { - if cmd.Overwrite { - dash.Id = existing.Id - } else { - return m.ErrDashboardWithSameNameExists - } + if dash.Id > 0 { + dashWithIdExists, err := sess.Where("id=? AND org_id=?", dash.Id, dash.OrgId).Get(&existing) + if err != nil { + return err } + if !dashWithIdExists { + return m.ErrDashboardNotFound + } + // check for is someone else has written in between if dash.Version != existing.Version { if cmd.Overwrite { @@ -48,6 +44,22 @@ func SaveDashboard(cmd *m.SaveDashboardCommand) error { } } + sameTitleExists, err := sess.Where("org_id=? AND slug=?", dash.OrgId, dash.Slug).Get(&sameTitle) + if err != nil { + return err + } + + if sameTitleExists { + // another dashboard with same name + if dash.Id != sameTitle.Id { + if cmd.Overwrite { + dash.Id = sameTitle.Id + } else { + return m.ErrDashboardWithSameNameExists + } + } + } + affectedRows := int64(0) if dash.Id == 0 { diff --git a/pkg/services/sqlstore/dashboard_test.go b/pkg/services/sqlstore/dashboard_test.go index 4c6614ed774..ad4974af18b 100644 --- a/pkg/services/sqlstore/dashboard_test.go +++ b/pkg/services/sqlstore/dashboard_test.go @@ -66,6 +66,24 @@ func TestDashboardDataAccess(t *testing.T) { So(err, ShouldNotBeNil) }) + Convey("Should not be able to overwrite dashboard in another org", func() { + query := m.GetDashboardQuery{Slug: "test-dash-23", OrgId: 1} + GetDashboard(&query) + + cmd := m.SaveDashboardCommand{ + OrgId: 2, + Overwrite: true, + Dashboard: map[string]interface{}{ + "id": float64(query.Result.Id), + "title": "Expect error", + "tags": []interface{}{}, + }, + } + + err := SaveDashboard(&cmd) + So(err, ShouldNotBeNil) + }) + Convey("Should be able to search for dashboard", func() { query := m.SearchDashboardsQuery{ Title: "test",