public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Alerting: fix bug where user is able to access rules from namespaces user is not part of (#41403) (#41406)

Browse Source 
* Add fix
* Add tests
(cherry picked from commit 6220872633)

Co-authored-by: Yuriy Tseretyan <yuriy.tseretyan@grafana.com>
Co-authored-by: Armand Grillet <2117580+armandgrillet@users.noreply.github.com>
Co-authored-by: Jean-Philippe Quéméner <JohnnyQQQQ@users.noreply.github.com>
Co-authored-by: George Robinson <george.robinson@grafana.com>
Co-authored-by: gotjosh <josue@grafana.com>
This commit is contained in:
Grot (@grafanabot)
2021-11-08 10:57:51 -07:00
committed by GitHub
parent adfd39e5fd
commit 3b8be57b4f
4 changed files with 55 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/tests/api/alerting/api_ruler_test.go
+18
View File
@@ -245,6 +245,24 @@ func TestAlertRulePermissions(t *testing.T) {
}`
assert.JSONEq(t, expectedGetNamespaceResponseBody, body)
}
// Remove permissions from ALL folders.
require.NoError(t, store.UpdateDashboardACL(1, nil))
{
u := fmt.Sprintf("http://grafana:password@%s/api/ruler/grafana/api/v1/rules", grafanaListedAddr)
// nolint:gosec
resp, err := http.Get(u)
require.NoError(t, err)
t.Cleanup(func() {
err := resp.Body.Close()
require.NoError(t, err)
})
b, err := ioutil.ReadAll(resp.Body)
require.NoError(t, err)
assert.Equal(t, resp.StatusCode, 200)
require.JSONEq(t, `{}`, string(b))
}
}
func createRule(t *testing.T, grafanaListedAddr string, folder string, user, password string) {