public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Alerting: Fix access to alerts for viewer with editor permissions when RBAC is disabled (#49270)

Browse Source 
* Add folder edit permission for users with Viewer role
* relax permissions required to create an alert when RBAC is disabled
This commit is contained in:
Yuriy Tseretyan
2022-05-23 09:58:20 -04:00
committed by GitHub
parent c29e6fcb3a
commit 3dfafbadef
12 changed files with 61 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/ngalert/api/authorization.go
+1
View File
@@ -49,6 +49,7 @@ func (api *API) authorize(method, path string) web.Handler {
case http.MethodGet + "/api/ruler/grafana/api/v1/rules":
eval = ac.EvalPermission(ac.ActionAlertingRuleRead)
case http.MethodPost + "/api/ruler/grafana/api/v1/rules/{Namespace}":
fallback = middleware.ReqSignedIn // if RBAC is disabled then we need to delegate permission check to folder because its permissions can allow editing for Viewer role
scope := dashboards.ScopeFoldersProvider.GetResourceScopeName(ac.Parameter(":Namespace"))
// more granular permissions are enforced by the handler via "authorizeRuleChanges"
eval = ac.EvalAny(