From 3b637f4b442f1f161531ac5573d43ff9aaa0808a Mon Sep 17 00:00:00 2001 From: Emil Tullstedt Date: Thu, 4 Nov 2021 09:59:52 +0100 Subject: [PATCH] Access control: Redirect non-API calls (#41100) --- pkg/services/accesscontrol/middleware/middleware.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkg/services/accesscontrol/middleware/middleware.go b/pkg/services/accesscontrol/middleware/middleware.go index 0f146e20224..b2067b02ffb 100644 --- a/pkg/services/accesscontrol/middleware/middleware.go +++ b/pkg/services/accesscontrol/middleware/middleware.go @@ -7,6 +7,7 @@ import ( "github.com/grafana/grafana/pkg/models" "github.com/grafana/grafana/pkg/services/accesscontrol" + "github.com/grafana/grafana/pkg/setting" "github.com/grafana/grafana/pkg/util" "github.com/grafana/grafana/pkg/web" ) @@ -46,6 +47,12 @@ func Deny(c *models.ReqContext, evaluator accesscontrol.Evaluator, err error) { ) } + if !c.IsApiRequest() { + // TODO(emil): I'd like to show a message after this redirect, not sure how that can be done? + c.Redirect(setting.AppSubUrl + "/") + return + } + // If the user triggers an error in the access control system, we // don't want the user to be aware of that, so the user gets the // same information from the system regardless of if it's an