public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Snapshots: Fix deleting snapshot with non existent dashboard ID (#64345)

Browse Source 
* Add test for deleting snapshot for non existent dashboard

* Add test for failure to fetch guardian other than ErrDashboardNotFound

* Fix dashboard snapshot delete
This commit is contained in:
Sofia Papagiannaki
2023-03-08 10:12:02 +02:00
committed by GitHub
parent 05191d083d
commit 43095d84e4
2 changed files with 58 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/dashboard_snapshot.go
+12 -10
View File
@@ -366,17 +366,19 @@ func (hs *HTTPServer) DeleteDashboardSnapshot(c *contextmodel.ReqContext) respon
if dashboardID != 0 {
g, err := guardian.New(c.Req.Context(), dashboardID, c.OrgID, c.SignedInUser)
if err != nil {
return response.Err(err)
}
if !errors.Is(err, dashboards.ErrDashboardNotFound) {
return response.Err(err)
}
} else {
canEdit, err := g.CanEdit()
// check for permissions only if the dashboard is found
if err != nil && !errors.Is(err, dashboards.ErrDashboardNotFound) {
return response.Error(http.StatusInternalServerError, "Error while checking permissions for snapshot", err)
}
canEdit, err := g.CanEdit()
// check for permissions only if the dashboard is found
if err != nil && !errors.Is(err, dashboards.ErrDashboardNotFound) {
return response.Error(http.StatusInternalServerError, "Error while checking permissions for snapshot", err)
}
if !canEdit && queryResult.UserID != c.SignedInUser.UserID && !errors.Is(err, dashboards.ErrDashboardNotFound) {
return response.Error(http.StatusForbidden, "Access denied to this snapshot", nil)
if !canEdit && queryResult.UserID != c.SignedInUser.UserID && !errors.Is(err, dashboards.ErrDashboardNotFound) {
return response.Error(http.StatusForbidden, "Access denied to this snapshot", nil)
}
}
}