From 3ace91016ebf7034f95ce1843370b36d96c6a18c Mon Sep 17 00:00:00 2001 From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com> Date: Fri, 22 Jul 2022 10:08:50 +0100 Subject: [PATCH] Fix anonymous access (#52615) (#52635) (cherry picked from commit 8d938175f5d770c6a33921673a5d321328c25881) Co-authored-by: Gabriel MABILLE --- .../dashboards/manager/dashboard_service.go | 4 ++-- pkg/services/dashboards/manager/folder_service.go | 14 +++++++++++--- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/pkg/services/dashboards/manager/dashboard_service.go b/pkg/services/dashboards/manager/dashboard_service.go index 9d84340e941..f529e3d7efc 100644 --- a/pkg/services/dashboards/manager/dashboard_service.go +++ b/pkg/services/dashboards/manager/dashboard_service.go @@ -450,7 +450,7 @@ func (dr *DashboardServiceImpl) setDefaultPermissions(ctx context.Context, dto * inFolder := dash.FolderId > 0 if !accesscontrol.IsDisabled(dr.cfg) { var permissions []accesscontrol.SetResourcePermissionCommand - if !provisioned { + if !provisioned && dto.User.IsRealUser() && !dto.User.IsAnonymous { permissions = append(permissions, accesscontrol.SetResourcePermissionCommand{ UserID: dto.User.UserId, Permission: models.PERMISSION_ADMIN.String(), }) @@ -472,7 +472,7 @@ func (dr *DashboardServiceImpl) setDefaultPermissions(ctx context.Context, dto * if err != nil { return err } - } else if dr.cfg.EditorsCanAdmin && !provisioned { + } else if dr.cfg.EditorsCanAdmin && !provisioned && dto.User.IsRealUser() && !dto.User.IsAnonymous { if err := dr.MakeUserAdmin(ctx, dto.OrgId, dto.User.UserId, dash.Id, !inFolder); err != nil { return err } diff --git a/pkg/services/dashboards/manager/folder_service.go b/pkg/services/dashboards/manager/folder_service.go index 49641e26377..e01abaab39b 100644 --- a/pkg/services/dashboards/manager/folder_service.go +++ b/pkg/services/dashboards/manager/folder_service.go @@ -172,12 +172,20 @@ func (f *FolderServiceImpl) CreateFolder(ctx context.Context, user *models.Signe var permissionErr error if !accesscontrol.IsDisabled(f.cfg) { - _, permissionErr = f.permissions.SetPermissions(ctx, orgID, folder.Uid, []accesscontrol.SetResourcePermissionCommand{ - {UserID: userID, Permission: models.PERMISSION_ADMIN.String()}, + var permissions []accesscontrol.SetResourcePermissionCommand + if user.IsRealUser() && !user.IsAnonymous { + permissions = append(permissions, accesscontrol.SetResourcePermissionCommand{ + UserID: userID, Permission: models.PERMISSION_ADMIN.String(), + }) + } + + permissions = append(permissions, []accesscontrol.SetResourcePermissionCommand{ {BuiltinRole: string(models.ROLE_EDITOR), Permission: models.PERMISSION_EDIT.String()}, {BuiltinRole: string(models.ROLE_VIEWER), Permission: models.PERMISSION_VIEW.String()}, }...) - } else if f.cfg.EditorsCanAdmin { + + _, permissionErr = f.permissions.SetPermissions(ctx, orgID, folder.Uid, permissions...) + } else if f.cfg.EditorsCanAdmin && user.IsRealUser() && !user.IsAnonymous { permissionErr = f.MakeUserAdmin(ctx, orgID, userID, folder.Id, true) }