Role checking when saving dashboard, making sure that the user has owner or editor role

pkg/api/api.go

@@ -13,6 +13,7 @@ import (
 func Register(r *macaron.Macaron) {
 	reqSignedIn := middleware.Auth(&middleware.AuthOptions{ReqSignedIn: true})
 	reqGrafanaAdmin := middleware.Auth(&middleware.AuthOptions{ReqSignedIn: true, ReqGrafanaAdmin: true})
+	reqEditorRole := middleware.RoleAuth(m.ROLE_EDITOR, m.ROLE_OWNER)
 	bind := binding.Bind
 
 	// not logged in views
@@ -63,7 +64,7 @@ func Register(r *macaron.Macaron) {
 		// Dashboard
 		r.Group("/dashboard", func() {
 			r.Combo("/:slug").Get(GetDashboard).Delete(DeleteDashboard)
-			r.Post("/", bind(m.SaveDashboardCommand{}), PostDashboard)
+			r.Post("/", reqEditorRole, bind(m.SaveDashboardCommand{}), PostDashboard)
 		})
 		// Search
 		r.Get("/search/", Search)

pkg/middleware/auth.go

@@ -60,6 +60,21 @@ func authDenied(c *Context) {
 	c.Redirect(setting.AppSubUrl + "/login")
 }
 
+func RoleAuth(roles ...m.RoleType) macaron.Handler {
+	return func(c *Context) {
+		ok := false
+		for _, role := range roles {
+			if role == c.UserRole {
+				ok = true
+				break
+			}
+		}
+		if !ok {
+			authDenied(c)
+		}
+	}
+}
+
 func Auth(options *AuthOptions) macaron.Handler {
 	return func(c *Context) {
 

pkg/services/sqlstore/sqlstore.go

@@ -14,6 +14,7 @@ import (
 
 	_ "github.com/go-sql-driver/mysql"
 	"github.com/go-xorm/xorm"
+	_ "github.com/lib/pq"
 	_ "github.com/mattn/go-sqlite3"
 )