From 447a2d4d823f5a65996e4b89d04fc5e74fe5afae Mon Sep 17 00:00:00 2001 From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com> Date: Wed, 3 Aug 2022 14:54:18 +0100 Subject: [PATCH] Access Control: Fix permission error during dashboard creation flow (#53214) (#53229) * remove permission check * remove unneeded function (cherry picked from commit 610abc2af0ea9de4cf3f8ef7ba4d3fedfcdb83a5) Co-authored-by: Ieva --- pkg/services/libraryelements/database.go | 4 ---- pkg/services/libraryelements/guard.go | 14 -------------- 2 files changed, 18 deletions(-) diff --git a/pkg/services/libraryelements/database.go b/pkg/services/libraryelements/database.go index 6b57841fbbf..86e1ed7d6c0 100644 --- a/pkg/services/libraryelements/database.go +++ b/pkg/services/libraryelements/database.go @@ -648,10 +648,6 @@ func (l *LibraryElementService) getElementsForDashboardID(c context.Context, das // connectElementsToDashboardID adds connections for all elements Library Elements in a Dashboard. func (l *LibraryElementService) connectElementsToDashboardID(c context.Context, signedInUser *models.SignedInUser, elementUIDs []string, dashboardID int64) error { - if err := l.requireEditPermissionsOnDashboard(c, signedInUser, dashboardID); err != nil { - return err - } - err := l.SQLStore.WithTransactionalDbSession(c, func(session *sqlstore.DBSession) error { _, err := session.Exec("DELETE FROM "+models.LibraryElementConnectionTableName+" WHERE kind=1 AND connection_id=?", dashboardID) if err != nil { diff --git a/pkg/services/libraryelements/guard.go b/pkg/services/libraryelements/guard.go index 7795a5f58cf..01ba36cf1fe 100644 --- a/pkg/services/libraryelements/guard.go +++ b/pkg/services/libraryelements/guard.go @@ -72,17 +72,3 @@ func (l *LibraryElementService) requireViewPermissionsOnFolder(ctx context.Conte return nil } - -func (l *LibraryElementService) requireEditPermissionsOnDashboard(ctx context.Context, user *models.SignedInUser, dashboardID int64) error { - g := guardian.New(ctx, dashboardID, user.OrgId, user) - - canEdit, err := g.CanEdit() - if err != nil { - return err - } - if !canEdit { - return dashboards.ErrDashboardUpdateAccessDenied - } - - return nil -}